Splunk Search

events results time in milliseconds

erez10121012
Path Finder

hi,

i sent Splunk value, for example x=1. after 10 milliseconds i send again x=2 etc.

when i search for x. i see in the event viewer, time format of milliseconds. but its always .000, only the sec is increase.

how i change Splunk time to show the real milliseconds  and not .000?

thanks

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Then the best option is that you add time stamp with ms and time zone information to your message as splunk cannot addition to tcp stream on server side.

On splunk side  use also separate sourcetype (not syslog as this event is not syslog format) to your events.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

How you are sending those events to Splunk? Can you share your inputs and props configs?

r. Ismo

0 Karma

erez10121012
Path Finder

i sent tcp port 512  string "x=1"

when i search in splunk for x i see all the message that i send.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf Shows that tcp didn’t support _time added by Splunk. Udp supports it, but it has another issues like missing events time by time. 

Are you using syslog or other client which are handling sending parts?

0 Karma

erez10121012
Path Finder

hi

this is the results.

way the millisecond is all the time 000?

erez10121012_0-1594665451779.png

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

It seems that you are using syslog to sending these events to splunk. Normally syslog use only seconds not ms to show a time. Here is the instructions how to add ms to Linux syslog https://serverfault.com/questions/373627/increase-rsyslog-syslog-precision-to-include-fractional-sec...

r. Ismo

0 Karma

erez10121012
Path Finder

thanks

but i dont send the time to splunk, only the value.

it is not windows time?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Probably you are using some command / library which is using syslog to send events to splunk over network or have you a own code which are directly writing that data to splunk server tcp socket?

0 Karma

erez10121012
Path Finder

hi

i just send simple TCP (even not syslog) to splunk:

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.send(bytes(str(x=1), 'utf-8'))

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Then the best option is that you add time stamp with ms and time zone information to your message as splunk cannot addition to tcp stream on server side.

On splunk side  use also separate sourcetype (not syslog as this event is not syslog format) to your events.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...