WinEventLog Milli seconds identification.

[thirumalreddyb]

Splunk is not parsing the milliseconds into _time field. How to parse it during the index time?

I have updated my TIME_FORMAT in props in all the search peers; yet it is not parsing properly.

Thanks in advance.

[hettervik]

After looking some more into the problem with Splunk not extracting milliseconds from WinEventLog, I found this thread:

https://answers.splunk.com/answers/489938/splunk-add-on-for-microsoft-windows-why-is-timesta.html

It seems to be the answer for your question. Unfortunately the timestamp for WinEventLog is parsed at input time, and cannot be corrected later on at indexs time.

[hettervik]

Hi. Did you find out why your parsing for WinEventLog doen't extract the milliseconds? I seem to have the same problem. I've sat TIME_FORMAT in props.conf, but still it seems to be ignored. Also I've checked using the data onboarding UI in Splunk that the TIME_FORMAT setting is indeed correct for the logs.

[teunlaan]

Does you WinEventLog have milliseconds in the timestamp?

[thirumalreddyb]

I downvoted this post because this is not an answer. this prevented others from looking into the question.

[thirumalreddyb]

Yes, this is that format => %Y-%m-%dT%H:%M:%S.%9NZ

[teunlaan]

so if you do index=windows| table _raw You also see the milliseconds in the message?

how do you collect the Wineventlog? "normal" or by xml?

[thirumalreddyb]

We collect them in xml format.