I collect some events into a summary index with something like this:
... some search ... | rex ... | eval ... | fields ... | fields - _raw | collect index=summary marker="search_type=mysearchtype"
Surprisingly, _time
saved into summary
index loses its milliseconds (they become zeroes). If I add something like | eval start_time = time | fields ..., start_time ...
, that collected start_time
does contain the milliseconds while the collected _time
doesn't! This is happening in 6.2.1.
Not urgent since I have the workaround - just weird...
You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect
produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.
You need the raw to carry over the milliseconds. These are done at search time; index time is only to second-level granularity. I haven't had a look at the actual spool files that | collect
produces, because they're ephemeral, and are gone before I can catch them. I suspect that they don't carry millis there and are indexed at second-level. You'll have to continue with your workarounds, it seems.
Also happens on Splunk 6.2.3
My workaround is to use ... | eval fractionalSeconds = _time % 1
in the populating search and EVAL-_time = (_time + fractionalSeconds)
in my props.conf
.
Also happens on Splunk 6.3.3.
I didn't found it as a Known Issue.
Do you have any workaround without touching props.conf ? I use Splunk 7.0.8.5 .
Thanks