Getting Data In

TIME_FORMAT Ignoring Milliseconds

llow
Explorer

I'm having problems getting Splunk (through data preview) from correctly parsing the following timestamp:

2013.08.14 12:47:02:467 MST

I am using the format below but the milliseconds are ignored and Splunk shows '8/14/13 12:47:02.000 PM' instad of '8/14/13 12:47:02.467 PM'

TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z

Tags (1)

rturk
Builder

Hi Llow,

Your TIME_FORMAT looks OK. Is the timestamp that's being parsed at the start or mid-way through an event?

One thing I've noticed with the data preview is that sometimes the preview doesn't fully extract the timestamp, while submitting the change and viewing it in Splunk proper will. I found this quite recently helping out with this question:

http://answers.splunk.com/answers/101487/striptime-not-parsing-time-stamps

The milliseconds were not detected in the preview, but were fine once put into Splunk.

I'd recommend throwing your data into a test index to confirm for yourself.

Hope this helps :slightly_smiling_face:

0 Karma

rturk
Builder

Can you edit your original question to include two or three redacted sample events?

0 Karma

llow
Explorer

The timestamp is at the very beginning of a multi-line event. I have also played with TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD without luck.

The current config I have is:

NO_BINARY_CHECK=1
BREAK_ONLY_BEFORE_DATE=true
CHARSET=ISO-8859-1
LEARN_SOURCETYPE=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=27

I've tried uploading a file into the index to make sure it wasn't a problem with the data previewer but it still comes in without the milliseconds.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...