Knowledge Management

Why are collected events in a summary index losing milliseconds from _time in Splunk 6.2.1?

arkadyz1
Builder

I collect some events into a summary index with something like this:

... some search ... | rex ... | eval ... | fields ... | fields - _raw | collect index=summary marker="search_type=mysearchtype"

Surprisingly, _time saved into summary index loses its milliseconds (they become zeroes). If I add something like | eval start_time = time | fields ..., start_time ..., that collected start_time does contain the milliseconds while the collected _time doesn't! This is happening in 6.2.1.

Not urgent since I have the workaround - just weird...

1 Solution

sowings
Splunk Employee
Splunk Employee

You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.

View solution in original post

sowings
Splunk Employee
Splunk Employee

You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.

krdo
Communicator

Also happens on Splunk 6.2.3
My workaround is to use ... | eval fractionalSeconds = _time % 1 in the populating search and EVAL-_time = (_time + fractionalSeconds) in my props.conf.

eliazanaboni
Engager

Also happens on Splunk 6.3.3.
I didn't found it as a Known Issue.

0 Karma

Anantha123
Communicator

Do you have any workaround without touching props.conf ? I use Splunk 7.0.8.5 .

Thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...