JSON miliseconds not taken from timestamp

[przemysaw]

Hi!
I have a json log and dedicated sourcetype for it. Sourcetype looks like this:

[json]
disabled=false
KV_MODE=json
pulldown_type=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD=200
TIMESTAMP_FIELDS=@timestamp
TRUNCATE=50000
SHOULD_LINEMERGE=false

But when it comes to see the event in Splunk it looks like it does not resolve the full timestamp. I.e. the beginning of the raw event looks like this: {"@timestamp":"2019-02-20T07:51:09.003+00:00"
While in Splunk I can see the time of an event: 19-02-20 08:51:09,000
It does not take miliseconds. Do you see any mistake in the sourcetype configuration, why miliseconds are skipped?

Best Regards,
Przemek

[chrisyounger · Accepted solution]

You can't use TIMESTAMP_FIELDS if you are using search time extractions ( KV_MODE=json )

Search time extraction is best anyway. So instead do this:

TIME_PREFIX = timestamp":"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z

[przemysaw]

and it helped, now I can see miliseconds in the event time - many thanks!

[harsmarvania57]

Hi,

Are you ingesting this JSON logs using Splunk Universal Forwarder ? If yes then you can use INDEXED_EXTRACTIONS = JSON on UF and KV_MODE = none on Search Head.