I am not able to capture milliseconds in accelerated data model.
Query is like :
|tstats max(time) as Start min(time) as End from datamodel=One.A where nodename=B.A by A.Id|eval duration=End-Start
Raw logs are having milliseconds but the above query is not having the milliseconds.
What happens if you try this
|tstats max(_time) as Start min(_time) as End from datamodel=One.A where nodename=B.A by A.Id| eval newstrt=strftime(Start,"%Y-%m-%d %H:%M:%S:%3N %p")| eval newend=strftime(End,"%Y-%m-%d %H:%M:%S:%3N %p")
Can you see milliseconds now?
Hi Suki, @Sukisen1981
if i search for last 15 - 20 mins milliseconds are displaying.. But if i search any older time than this.. then it is not displaying milliseconds.
My question is that while saving the data in the indexer (accelerated data model) will it not save the milliseconds?
I can't reproduce the issue with below query on 'Authentication' datamodel.
|tstats max(_time) as Start min(_time) as End from datamodel=One
Is yours custom datamodel? if it's standard one, can you share the datamodel name?