Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: WinEventLog Milli seconds identification.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
WinEventLog Milli seconds identification.
Splunk is not parsing the milliseconds into _time field. How to parse it during the index time?
I have updated my TIME_FORMAT in props in all the search peers; yet it is not parsing properly.
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After looking some more into the problem with Splunk not extracting milliseconds from WinEventLog, I found this thread:
https://answers.splunk.com/answers/489938/splunk-add-on-for-microsoft-windows-why-is-timesta.html
It seems to be the answer for your question. Unfortunately the timestamp for WinEventLog is parsed at input time, and cannot be corrected later on at indexs time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi. Did you find out why your parsing for WinEventLog doen't extract the milliseconds? I seem to have the same problem. I've sat TIME_FORMAT in props.conf, but still it seems to be ignored. Also I've checked using the data onboarding UI in Splunk that the TIME_FORMAT setting is indeed correct for the logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does you WinEventLog have milliseconds in the timestamp?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I downvoted this post because this is not an answer. this prevented others from looking into the question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, this is that format => %Y-%m-%dT%H:%M:%S.%9NZ
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so if you do index=windows| table _raw You also see the milliseconds in the message?
how do you collect the Wineventlog? "normal" or by xml?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We collect them in xml format.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
