Why are collected events in a summary index losing milliseconds from _time in Splunk 6.2.1?

[arkadyz1]

I collect some events into a summary index with something like this:

... some search ... | rex ... | eval ... | fields ... | fields - _raw | collect index=summary marker="search_type=mysearchtype"

Surprisingly, _time saved into summary index loses its milliseconds (they become zeroes). If I add something like | eval start_time = time | fields ..., start_time ..., that collected start_time does contain the milliseconds while the collected _time doesn't! This is happening in 6.2.1.

Not urgent since I have the workaround - just weird...

[sowings · Accepted solution]

You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.

[krdo]

Also happens on Splunk 6.2.3
My workaround is to use ... | eval fractionalSeconds = _time % 1 in the populating search and EVAL-_time = (_time + fractionalSeconds) in my props.conf.

[eliazanaboni]

Also happens on Splunk 6.3.3.
I didn't found it as a Known Issue.

[Anantha123]

Do you have any workaround without touching props.conf ? I use Splunk 7.0.8.5 .

Thanks