I have a MySQL table with column 'dateTimeOrigination' where each event records its time of occurrence in Linux time (epoch) like this: 1470925285 (standard 10 symbols). In Splunk DB Connect 2, I configure Output Timestamp Format=Epoch Time, Rising Column='dateTimeOrigination'. Metadata sourcetype is JSON.
What I have in output (indexed) is 1470925 (7 symbols), so Splunk converts it to 1/18/1970 and neither Output format works nor Java date can be established.
How this could happen (suddenly milliseconds are expected?) and how can I fix it?
note that you might need to use props.conf to deal with timezone (for instance the database is in UTC and has global times, but your Splunk is in local and therefore sees some of the records as coming from the future).
Thank you for quick reply and suggestion, we will update ASAP.
But I'm afraid there's something misconfigured or that I can configure so Splunk will not cut off last 3 symbols of original timestamp record. The events are indexing well, the problem it has wrong input for time.