TIME_FORMAT Ignoring Milliseconds

[llow]

I'm having problems getting Splunk (through data preview) from correctly parsing the following timestamp:

2013.08.14 12:47:02:467 MST

I am using the format below but the milliseconds are ignored and Splunk shows '8/14/13 12:47:02.000 PM' instad of '8/14/13 12:47:02.467 PM'

TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z

[rturk]

Hi Llow,

Your TIME_FORMAT looks OK. Is the timestamp that's being parsed at the start or mid-way through an event?

One thing I've noticed with the data preview is that sometimes the preview doesn't fully extract the timestamp, while submitting the change and viewing it in Splunk proper will. I found this quite recently helping out with this question:

http://answers.splunk.com/answers/101487/striptime-not-parsing-time-stamps

The milliseconds were not detected in the preview, but were fine once put into Splunk.

I'd recommend throwing your data into a test index to confirm for yourself.

Hope this helps 🙂

[rturk]

Can you edit your original question to include two or three redacted sample events?

[llow]

The timestamp is at the very beginning of a multi-line event. I have also played with TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD without luck.

The current config I have is:

NO_BINARY_CHECK=1
BREAK_ONLY_BEFORE_DATE=true
CHARSET=ISO-8859-1
LEARN_SOURCETYPE=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=27

I've tried uploading a file into the index to make sure it wasn't a problem with the data previewer but it still comes in without the milliseconds.