events results time in milliseconds

[erez10121012]

hi,

i sent Splunk value, for example x=1. after 10 milliseconds i send again x=2 etc.

when i search for x. i see in the event viewer, time format of milliseconds. but its always .000, only the sec is increase.

how i change Splunk time to show the real milliseconds  and not .000?

thanks

[isoutamo]

How you are sending those events to Splunk? Can you share your inputs and props configs?

r. Ismo

[erez10121012]

i sent tcp port 512  string "x=1"

when i search in splunk for x i see all the message that i send.

[isoutamo]

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf Shows that tcp didn’t support _time added by Splunk. Udp supports it, but it has another issues like missing events time by time. 

Are you using syslog or other client which are handling sending parts?

[erez10121012]

hi

this is the results.

way the millisecond is all the time 000?

[isoutamo]

It seems that you are using syslog to sending these events to splunk. Normally syslog use only seconds not ms to show a time. Here is the instructions how to add ms to Linux syslog https://serverfault.com/questions/373627/increase-rsyslog-syslog-precision-to-include-fractional-sec...

r. Ismo

[erez10121012]

thanks

but i dont send the time to splunk, only the value.

it is not windows time?

[isoutamo]

Probably you are using some command / library which is using syslog to send events to splunk over network or have you a own code which are directly writing that data to splunk server tcp socket?

[erez10121012]

hi

i just send simple TCP (even not syslog) to splunk:

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.send(bytes(str(x=1), 'utf-8'))

[isoutamo · Accepted solution]

Then the best option is that you add time stamp with ms and time zone information to your message as splunk cannot addition to tcp stream on server side.

On splunk side  use also separate sourcetype (not syslog as this event is not syslog format) to your events.

r. Ismo