Splunk Search

JSON miliseconds not taken from timestamp

przemysaw
Explorer

Hi!
I have a json log and dedicated sourcetype for it. Sourcetype looks like this:

[json]
disabled=false
KV_MODE=json
pulldown_type=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD=200
TIMESTAMP_FIELDS=@timestamp
TRUNCATE=50000
SHOULD_LINEMERGE=false

But when it comes to see the event in Splunk it looks like it does not resolve the full timestamp. I.e. the beginning of the raw event looks like this: {"@timestamp":"2019-02-20T07:51:09.003+00:00"
While in Splunk I can see the time of an event: 19-02-20 08:51:09,000
It does not take miliseconds. Do you see any mistake in the sourcetype configuration, why miliseconds are skipped?

Best Regards,
Przemek

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

You can't use TIMESTAMP_FIELDS if you are using search time extractions ( KV_MODE=json )

Search time extraction is best anyway. So instead do this:

TIME_PREFIX = timestamp":"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

You can't use TIMESTAMP_FIELDS if you are using search time extractions ( KV_MODE=json )

Search time extraction is best anyway. So instead do this:

TIME_PREFIX = timestamp":"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z

View solution in original post

0 Karma

przemysaw
Explorer

and it helped, now I can see miliseconds in the event time - many thanks!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Are you ingesting this JSON logs using Splunk Universal Forwarder ? If yes then you can use INDEXED_EXTRACTIONS = JSON on UF and KV_MODE = none on Search Head.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!