DB-Connect handling of epoch time

[a212830]

Hi,

I am having some issues getting db connect to properly parse an epoch timestamp. It appears to be translating it into midnight of that day, rather than the actual proper date.

This paticular timestamp also has decimal places, which I've never seen before on an epoch format.
Is there something special that needs to be done to get db connect to handle this? I have numerous other db inputs that have an epoch timestamp (without decimals) that work fine.

Example of timestamp with issues:
1366516800.000 (field is defined as DATE field)

Example of timestamp with no issues:
1367255100 (field is defined as NUMBER field)

My props.conf has both of them with a TIME_FORMAT = %s

[kristian_kolb]

Hi,

The timestamp you gave - 1366516800.000 - will translate to 04.00 UTC, 21 April 2013, which would be midnight in the eastern parts of North America, right? Do all of the 'faulty' timestamps match midnight in your timezone? Could be that it is used for the date only, and thus is set to midnight.

Anyway, the decimals indicate milliseconds, and have their own strptime variable; %3N

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Commontimeformatvariables

/K