Splunk not storing time in milliseconds

[ankith_nt]

I am extracting the timestamp from events in microseconds (%Y-%m-%d:%H:%M:%S.%6N). But when index event timestamp is not showing in sub seconds. Always I see zeroth subsecond in timestamp. Is there any overwritten possible other than by props?

[kmorris_splunk]

I think this is just a question of how Splunk shows _time. Try something like this to see if it helps.

<YOUR BASE SEARCH> 
| convert timeformat="%Y-%m-%d %H:%M:%S:%6N" ctime(_time) AS c_time 
| table c_time