go's time.RFC3339Nano format

[framirez_enova]

Anyone having issues with nano second formatting from JSON logs. Currently it seems like times get rounded up or something.

What's sent:      2020-09-11T10:23:44.30373164-05:00
What shows:     9/11/20 10:23:44.000 AM

If you have/experienced this issue, how are you coping with or how did you solved it?

[framirez_enova]

Interesting on the digit. Will keep that in mind.   I also reached out to splunk support and they advise to try this in the props.conf file for the source:

%Y-%m-%dT%H:%M:%S.%9N%:z

[isoutamo]

%F <=> %Y-%m-%d
%T <=> %H:%M:%S

Please check your source is there eight or nine digits and use based on that %8N or %9N otherwise this didn't work.

[isoutamo]

I think that _time field can show it only ms not with more digits. If you want see all then you must convert it to anther field e.g. eval fullTime = strftime(_time, “%FT%T.%8N%:z”)
You have only 8 digits on your example even ns have 9, maybe this can also affect here?