Getting Data In

TIME_FORMAT Ignoring Milliseconds

Explorer

I'm having problems getting Splunk (through data preview) from correctly parsing the following timestamp:

2013.08.14 12:47:02:467 MST

I am using the format below but the milliseconds are ignored and Splunk shows '8/14/13 12:47:02.000 PM' instad of '8/14/13 12:47:02.467 PM'

TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z

Tags (1)

Builder

Hi Llow,

Your TIME_FORMAT looks OK. Is the timestamp that's being parsed at the start or mid-way through an event?

One thing I've noticed with the data preview is that sometimes the preview doesn't fully extract the timestamp, while submitting the change and viewing it in Splunk proper will. I found this quite recently helping out with this question:

http://answers.splunk.com/answers/101487/striptime-not-parsing-time-stamps

The milliseconds were not detected in the preview, but were fine once put into Splunk.

I'd recommend throwing your data into a test index to confirm for yourself.

Hope this helps 🙂

0 Karma

Builder

Can you edit your original question to include two or three redacted sample events?

0 Karma

Explorer

The timestamp is at the very beginning of a multi-line event. I have also played with TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD without luck.

The current config I have is:

NO_BINARY_CHECK=1
BREAK_ONLY_BEFORE_DATE=true
CHARSET=ISO-8859-1
LEARN_SOURCETYPE=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=27

I've tried uploading a file into the index to make sure it wasn't a problem with the data previewer but it still comes in without the milliseconds.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!