Is timestamp extraction of milliseconds wrong?

[hrawat]

FYI, it's possible if you have HF => third party s2s => indexer.

[hrawat · Accepted solution]

There is no issue if it's HF==>IDX. HF directly sending to IDX.

It happens if HF==>(popular 3rd party s2s)==>IDX. HF sending to 3rd party over s2s and 3rd party sending to splunk indexer over s2s.

[ITWhisperer]

So, the solution is to perhaps use a different third party solution or raise defect with said third party and get them to fix their data corruption? 😀 (Not a Splunk problem!?)

[hrawat]

It's a FYI for all using 3rd party. Chances are many not paying attention on subsecond field value.

[hrawat]

That's right. Go to third party to fix the issue if possible. 

[ITWhisperer]

It looks that way - what configurations are you using?