Splunk Search

events results time in milliseconds

erez10121012
Path Finder

hi,

i sent Splunk value, for example x=1. after 10 milliseconds i send again x=2 etc.

when i search for x. i see in the event viewer, time format of milliseconds. but its always .000, only the sec is increase.

how i change Splunk time to show the real milliseconds  and not .000?

thanks

Labels (1)
0 Karma
1 Solution

soutamo
SplunkTrust
SplunkTrust

Then the best option is that you add time stamp with ms and time zone information to your message as splunk cannot addition to tcp stream on server side.

On splunk side  use also separate sourcetype (not syslog as this event is not syslog format) to your events.

r. Ismo

View solution in original post

0 Karma

soutamo
SplunkTrust
SplunkTrust

How you are sending those events to Splunk? Can you share your inputs and props configs?

r. Ismo

0 Karma

erez10121012
Path Finder

i sent tcp port 512  string "x=1"

when i search in splunk for x i see all the message that i send.

 

0 Karma

soutamo
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf Shows that tcp didn’t support _time added by Splunk. Udp supports it, but it has another issues like missing events time by time. 

Are you using syslog or other client which are handling sending parts?

0 Karma

erez10121012
Path Finder

hi

this is the results.

way the millisecond is all the time 000?

erez10121012_0-1594665451779.png

 

0 Karma

soutamo
SplunkTrust
SplunkTrust

It seems that you are using syslog to sending these events to splunk. Normally syslog use only seconds not ms to show a time. Here is the instructions how to add ms to Linux syslog https://serverfault.com/questions/373627/increase-rsyslog-syslog-precision-to-include-fractional-sec...

r. Ismo

0 Karma

erez10121012
Path Finder

thanks

but i dont send the time to splunk, only the value.

it is not windows time?

0 Karma

soutamo
SplunkTrust
SplunkTrust

Probably you are using some command / library which is using syslog to send events to splunk over network or have you a own code which are directly writing that data to splunk server tcp socket?

0 Karma

erez10121012
Path Finder

hi

i just send simple TCP (even not syslog) to splunk:

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.send(bytes(str(x=1), 'utf-8'))

 

0 Karma

soutamo
SplunkTrust
SplunkTrust

Then the best option is that you add time stamp with ms and time zone information to your message as splunk cannot addition to tcp stream on server side.

On splunk side  use also separate sourcetype (not syslog as this event is not syslog format) to your events.

r. Ismo

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!