Splunk Enterprise

Discrepancy in calculation with Time Stamp.

sivakrishna
Path Finder

Hi Team,

We are observing discrepancy in calculation when the timestamp is less the 100ms.

Example:

Response time: “2023-10-23 14:46:14.84”

Request time: “2023-10-23 14:46:13.948”

 

When “Response time – Request timevalue should be “136ms” but in Splunk it showing as “890ms”.

 

While calculating Splunk is considering inbound value as ““2023-10-23 14:46:14.840ms” instead of “.84ms” as its in 2 digits.

So, is there any possibility to resolve this discrepancy from the Splunk query level or .conf level. 

 

Regards,

Siva.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

+1 on that. Why in what system should 14.84 ever mean 14.084? That's what leading zeros are for. It's definitely an application error.

Also - where do you get that value from? It's the _time field or some other time? While the app should be fixed either way, if it's the main timestamp of the event, it's simply plain wrong in terms of it being the proper timestamp for the event.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

".84" is correctly interpreted as ".840".  Zero padding is always on the side away from the decimal.  The difference between the two timestamps is 892ms.

If the application reporting the event intended the timestamp to be "14.084" then it should be corrected.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...