Props.conf Timestamp Not Parsing

[jordanking1992]

Hello,

We have events that are being indexed with "index time" timestamps and would like to use the timestamp from the event itself. When i upload the logs to our standalone host, splunk recognizes the timestamps from the logs and present us with the following fields for that sourcetype. (see below) However, when we deploy this to our indexers and resttart the service, events come in with the what appears to be index time timestamps. For some reason, splunk isnt recognizing the milliseconds portion of the event.

Thoughts?

[sourcetype-a]
MAX_TIMESTAMP_LOOKAHEAD = 128
TIME_PREFIX = [
TIME_FORMAT = %m/%d/%y %H:%M:%S:%N %Z
BREAK_ONLY_BEFORE = ^[\d{1,2}/\d{1,2}/\d{1,2}\s+\d{1,2}:\d{1,2}:\d{1,2}
MAX_EVENTS = 10000

[woodcock]

Try this:

TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %H:%M:%S:%3N %Z
MAX_TIMESTAMP_LOOKAHEAD = 25

Deploy to the first full instance of Splunk that handles the events (HF or Indexers), restart all splunk instances there, send in new events and only check those (old events will stay broken); use _index_earliest=-5m to be sure that you are looking at newly-indexed events.

[shawnab]

Try using %3N

"For GNU date-time nanoseconds. Specify any sub-second parsing by providing the width: %3N = milliseconds, %6N = microseconds, %9N = nanoseconds."

https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configuretimestamprecognition