sub second event sorting

[briang67]

We have a log file which contains a 7 digit second timestamp like the below: 08:30:00.2124216

We periodically need to compare sub second times between events, but it looks like the splunk event _time only includes the first 3 second digits like: 08:30:00.212

the problem is when we do a sort by _time, we frequently see events that are out of order like the following: 08:30:00.2124216 08:30:00.2124215 (this should be the reverse)

Anyone know of a way to handle this? Can splunk be configured to recognize a more granular time stamp?

[dwaddle · Accepted solution]

I suggest you check out the TIME_FORMAT option. I had a similar question some time ago:

http://answers.splunk.com/questions/1946/time-format-and-subseconds

[gkanapathy]

You use %7N to capture 7 digits of subseconds.