Getting Data In

TIME_FORMAT Ignoring Milliseconds

llow
Explorer

I'm having problems getting Splunk (through data preview) from correctly parsing the following timestamp:

2013.08.14 12:47:02:467 MST

I am using the format below but the milliseconds are ignored and Splunk shows '8/14/13 12:47:02.000 PM' instad of '8/14/13 12:47:02.467 PM'

TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z

Tags (1)

rturk
Builder

Hi Llow,

Your TIME_FORMAT looks OK. Is the timestamp that's being parsed at the start or mid-way through an event?

One thing I've noticed with the data preview is that sometimes the preview doesn't fully extract the timestamp, while submitting the change and viewing it in Splunk proper will. I found this quite recently helping out with this question:

http://answers.splunk.com/answers/101487/striptime-not-parsing-time-stamps

The milliseconds were not detected in the preview, but were fine once put into Splunk.

I'd recommend throwing your data into a test index to confirm for yourself.

Hope this helps 🙂

0 Karma

rturk
Builder

Can you edit your original question to include two or three redacted sample events?

0 Karma

llow
Explorer

The timestamp is at the very beginning of a multi-line event. I have also played with TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD without luck.

The current config I have is:

NO_BINARY_CHECK=1
BREAK_ONLY_BEFORE_DATE=true
CHARSET=ISO-8859-1
LEARN_SOURCETYPE=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=27

I've tried uploading a file into the index to make sure it wasn't a problem with the data previewer but it still comes in without the milliseconds.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>