Splunk Search

Sub Millisecond timestamp granularity?

au_chrismor
Path Finder

I'm working on a rather novel use for Splunk at present; but it deals with aggregated logs with timestamps down to 0.1mS

There is no problem getting the data, since we're picking up log files from a rotation, but I need to know if Splunk will index at this level of time interval

Thanks

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

Splunk can store time down to a resolution of .000001 seconds if the input data supports it. You will likely have to specify a TIME_FORMAT to pick it up. See http://splunk-base.splunk.com/answers/1946/time_format-and-subseconds

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...