Splunk Search

JSON miliseconds not taken from timestamp

przemysaw
Explorer

Hi!
I have a json log and dedicated sourcetype for it. Sourcetype looks like this:

[json]
disabled=false
KV_MODE=json
pulldown_type=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD=200
TIMESTAMP_FIELDS=@timestamp
TRUNCATE=50000
SHOULD_LINEMERGE=false

But when it comes to see the event in Splunk it looks like it does not resolve the full timestamp. I.e. the beginning of the raw event looks like this: {"@timestamp":"2019-02-20T07:51:09.003+00:00"
While in Splunk I can see the time of an event: 19-02-20 08:51:09,000
It does not take miliseconds. Do you see any mistake in the sourcetype configuration, why miliseconds are skipped?

Best Regards,
Przemek

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

You can't use TIMESTAMP_FIELDS if you are using search time extractions ( KV_MODE=json )

Search time extraction is best anyway. So instead do this:

TIME_PREFIX = timestamp":"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

You can't use TIMESTAMP_FIELDS if you are using search time extractions ( KV_MODE=json )

Search time extraction is best anyway. So instead do this:

TIME_PREFIX = timestamp":"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z

przemysaw
Explorer

and it helped, now I can see miliseconds in the event time - many thanks!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Are you ingesting this JSON logs using Splunk Universal Forwarder ? If yes then you can use INDEXED_EXTRACTIONS = JSON on UF and KV_MODE = none on Search Head.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...