Splunk timestamp Milliseconds vs Microseconds

[jadengoho]

Hi All,
What would be the impact if i use "%Q" rather than "%6Q" ?
Cause i'm seeing a 20min time delay on Splunk ingestion, is this because of this or not ?

Log Example:
- 2020-03-08-15.31.10.838384
- 2020-02-01-18.25.15.738385

https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commontimeformatvariables
https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/Troubleshootingeventsindexingdela...

[richgalloway · Accepted solution]

Using the wrong time variable may prevent Splunk from matching your data. At best, it will only accept 3 decimal places.
Since %Q is the same as %3Q, which does not match microseconds, you should use %6Q.

I doubt this explains the 20-minute delay, however. Have you verified the clocks are correct on all systems?

[jadengoho]

Yes the clocks are correct, maybe it's due to other stuff on their server.
Thanks.