As you say, for the most part, Splunk is reading it correctly, although Splunk doesn't seem to be considering the subseconds. It appears that Splunk does accept tai64, though I note that only this part of the timestamp (@400000004c3729d9) is read, the rest of it represents subseconds.
Maybe a custom datetime.xml would let it get the subseconds too? Worth a try, at least.
If you do the actual math the timestamp @400000004c3729d9 is hex 0x4c3729d9 seconds past 1970/01/01:00:00:00, which is 1278683609 in decimal, which (taken modulo 60) is 29 seconds past the minute.
The ten second difference has something to do with leap seconds:
http://en.wikipedia.org/wiki/Leap_second
Therefore, all things considered, Splunk is correct if we take it as TAI format used to represent UTC (which is what unix epoch is in practice), vs if it's TAI format supposed to represent actual TAI, in which case, both Splunk and daemontools are actually wrong because neither is correcting for leap seconds (but from different start dates).
-- posted on behalf of Gerald K, King of Splunk Answers --
... View more
