Hi
I am receiving a syslog feed from a server.I am trying to index that data. In syslog feed no milliseconds are being sent in feed.So event datetiime is of format 8/31/12 11:44:18*.000* AM
i.e milliseconds is always .000 for all events indexed.
So while calculating duration after using transaction command if transaction happens in less than a second then the duration shows as O, which is claerly wrong.
So is there a way i can append current date time with milliseconds when getting indexed, so that i get proper milliseconds feild also.