Getting Data In

sub second event sorting

Communicator

We have a log file which contains a 7 digit second timestamp like the below: 08:30:00.2124216

We periodically need to compare sub second times between events, but it looks like the splunk event _time only includes the first 3 second digits like: 08:30:00.212

the problem is when we do a sort by _time, we frequently see events that are out of order like the following: 08:30:00.2124216 08:30:00.2124215 (this should be the reverse)

Anyone know of a way to handle this? Can splunk be configured to recognize a more granular time stamp?

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

I suggest you check out the TIME_FORMAT option. I had a similar question some time ago:

http://answers.splunk.com/questions/1946/time-format-and-subseconds

View solution in original post

SplunkTrust
SplunkTrust

I suggest you check out the TIME_FORMAT option. I had a similar question some time ago:

http://answers.splunk.com/questions/1946/time-format-and-subseconds

View solution in original post

Splunk Employee
Splunk Employee

You use %7N to capture 7 digits of subseconds.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!