FYI, it's possible if you have HF => third party s2s => indexer.
There is no issue if it's HF==>IDX. HF directly sending to IDX.
It happens if HF==>(popular 3rd party s2s)==>IDX. HF sending to 3rd party over s2s and 3rd party sending to splunk indexer over s2s.
View solution in original post
So, the solution is to perhaps use a different third party solution or raise defect with said third party and get them to fix their data corruption? 😀 (Not a Splunk problem!?)
It's a FYI for all using 3rd party. Chances are many not paying attention on subsecond field value.
That's right. Go to third party to fix the issue if possible.
It looks that way - what configurations are you using?
