Knowledge Management

Why are collected events in a summary index losing milliseconds from _time in Splunk 6.2.1?

Builder

I collect some events into a summary index with something like this:

... some search ... | rex ... | eval ... | fields ... | fields - _raw | collect index=summary marker="search_type=mysearchtype"

Surprisingly, _time saved into summary index loses its milliseconds (they become zeroes). If I add something like | eval start_time = time | fields ..., start_time ..., that collected start_time does contain the milliseconds while the collected _time doesn't! This is happening in 6.2.1.

Not urgent since I have the workaround - just weird...

1 Solution

Splunk Employee
Splunk Employee

You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.

View solution in original post

Splunk Employee
Splunk Employee

You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.

View solution in original post

Communicator

Also happens on Splunk 6.2.3
My workaround is to use ... | eval fractionalSeconds = _time % 1 in the populating search and EVAL-_time = (_time + fractionalSeconds) in my props.conf.

Engager

Also happens on Splunk 6.3.3.
I didn't found it as a Known Issue.

0 Karma

Communicator

Do you have any workaround without touching props.conf ? I use Splunk 7.0.8.5 .

Thanks

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!