I'm working on a rather novel use for Splunk at present; but it deals with aggregated logs with timestamps down to 0.1mS
There is no problem getting the data, since we're picking up log files from a rotation, but I need to know if Splunk will index at this level of time interval
Thanks
Splunk can store time down to a resolution of .000001 seconds if the input data supports it. You will likely have to specify a TIME_FORMAT to pick it up. See http://splunk-base.splunk.com/answers/1946/time_format-and-subseconds