This is possible, but this approach requires a datamodel amendment. If an ordinary search of the index showed timestamps with sub-seconds: image001.png   but the equivalent tstats search did not: image002.png   the workaround is to modify the datamodel to add another field which takes a copy of the full timestamp.  That additional field can either be retained like other fields or can be used to reinstate the timestamp with sub-second detail.  For example, create a calculated field “time_millis” that just takes a copy of _time. image003.png   Now, if you return to  your tstats search from earlier and include time_millis, you can display time_millis and/or use it to reinstate the milliseconds of the _time field (i.e.  | eval _time=time_miilis): image004.png   ... View more

I had this error on v6.63 while setting the path of a G: drive for the coldToFrozenDir on windows - this was fixed by writing as: G:/ ... View more