Splunk Search

Sort results down to the millisecond

trozza
Engager

Currently in our log files, the _time value is rounded down to the nearest second and is sorted accordingly.

But in our event tab, the start of each log follows this exact pattern:

2018-10-17 17:53:42.8332

The part in bold is the milliseconds and I want to be able to include in my query:

  1. The ability to search (possibly regex?) the start of each result and pick up the millisecond value.
  2. Sort the results based on this so that results are sorted down to the millisecond.

I'm not too sure of how to approach this, I haven't really need this question asked yet so any guidance on what to do would be greatly appreciated 🙂

0 Karma

christianhuber
Path Finder

theoreticaly you just could create a new field out your timestamp and sort your events after that field

2018-10-17 17:53:42.8332 -> 201810171753428332
2018-10-17 17:53:42.8215 -> 201810171753428215
2018-10-17 17:53:42.8198 -> 201810171753428198

the _time field will not support miliseconds.

| sort _time, your_new_field

trozza
Engager

Thanks for the idea!

What would be the best way to create a new field out of this timestamp, given that it currently isn't captured in a field, just is raw data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...