Hi All, I am having issues with parsing of JSON logs time format in miliseconds. This is the format of my JSON logs. {"l":1239,"t":1660632134927,"publicationMode":"NORMAL","sequenceTime":3,"requestRead":0,"returnCode":200,"ownerName":"ihsmarkit_uxssd_inbound","payload":500,"requestId":"8fe635c7-f375-466d-aa24-a9abf9512d74","entityName":"Session","publication":5,"serverTime":12,"persist":4,"deserialize":0,"mergeTime":0,"eventId":"P81.1660632134.005","headers":{"Accept":"application\/json","resource":"\/uxssd\/Session","Connection":"close","User-Agent":"Jetty\/9.4.21.v20190926","X-Forwarded-For":"10.186.77.134","Host":"feed.dev.datadelivery.info","Accept-Encoding":"gzip","Content-Length":"1607","X-Real-IP":"10.186.77.134","Content-Type":"multipart\/form-data; boundary=JettyHttpClientBoundary199ah6aq27cmi5vr"},"method":"POST","ip":"10.186.77.134","accountUniqueId":"259B35941636A89528C138288A05","format":"JSON","requestOutcome":"SUCCESS","sessionId":"2A7460F81829F7912DC0E7192B0263844A275FBC0ACE195***@dv11","params":{"data":"Bytes:500","apiKey":"2A7460F81829F7912DC0E7192B0263844A275FBC0ACE195***@dv11","dataFormat":"JSON","httpMethod":"POST","messageType":"MERGE","requestId":"8fe635c7-f375-466d-aa24-a9abf9512d74","dictionaryVersion":"1","entity":"Session"},"processed":1,"sequence":9250657,"validationTime":0,"entities":{"Session":1},"success":true,"namespace":"uxssd"} In this first line we can see the time format which is "t":1660632134927 and this is my current props.conf. [json] TIME_FORMAT = %s%3N TIME_PREFIX = t:\s+ MAX_TIMESTAMP_LOOKAHEAD = 300 BREAK_ONLY_BEFORE_DATE = true NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TRUNCATE = 200000 LINE_BREAKER = ^\{ description = mon-4637 disabled = false Time extraction is happening properly with miliseconds are not getting extracted as expected. This is the current output - 8/16/22 6:42:14.000 AM But ideally it should be with miliseconds like example - 8/16/22 6:42:14.927 AM Please sugesst what changes I need to do in my props.conf so that miliseconds are also visible in time Splunk Event. Any help here will be highly appreciated.
... View more