Currently in our log files, the _time value is rounded down to the nearest second and is sorted accordingly.
But in our event tab, the start of each log follows this exact pattern:
The part in bold is the milliseconds and I want to be able to include in my query:
I'm not too sure of how to approach this, I haven't really need this question asked yet so any guidance on what to do would be greatly appreciated 🙂
theoreticaly you just could create a new field out your timestamp and sort your events after that field
2018-10-17 17:53:42.8332 -> 201810171753428332
2018-10-17 17:53:42.8215 -> 201810171753428215
2018-10-17 17:53:42.8198 -> 201810171753428198
the _time field will not support miliseconds.
| sort _time, your_new_field
Thanks for the idea!
What would be the best way to create a new field out of this timestamp, given that it currently isn't captured in a field, just is raw data.