Getting Data In

What is the strptime-style %-variable that TIME_FORMAT would use for subseconds?

dwaddle
SplunkTrust
SplunkTrust

What is the strptime-style %-variable that TIME_FORMAT would use for subseconds? The docs for props.conf suggest the strptime manpage, but being a time_t (which has only second-level precision) there's no such information there.

Labels (1)
Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

jkat54
SplunkTrust
SplunkTrust

For short:
YYYY-MM-DD = %F
HH:MM:SS = %T

Ex.
TIME_FORMAT=%F %T,%3N

0 Karma

jrodman
Splunk Employee
Splunk Employee

To add detail to gkapanthy's answer, the %3N means you have 3 digits of subseconds (milliseconds) while %6N is microseconds. You could use %9N for nanoseconds (dtrace uses this granularity, for example).

We used system strptime at one point, nowadays we have our own implementation which supports a number of common extensions. All the subsecond conversion strings are equivalent if you specify the number of digits.

Note that our internal datastructures still store the data by the second, which means if you have very very large numbers of events in the same second (eg. hundreds of thousands), there can be some performance issues when having to sort them.

EDIT: matteo points out the bit about _time not containing subseconds was incorrect.

gkanapathy
Splunk Employee
Splunk Employee

2008-04-25 12:34:56.689 -> %Y-%m-%d %H:%M:%S.%3N

12:34:56,789012 -> %H:%M:%S,%6N

http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition#Enhanced_strptim...

Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...