- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- WinEventLog Milli seconds identification.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
WinEventLog Milli seconds identification.
Splunk is not parsing the milliseconds into _time field. How to parse it during the index time?
I have updated my TIME_FORMAT in props in all the search peers; yet it is not parsing properly.
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After looking some more into the problem with Splunk not extracting milliseconds from WinEventLog, I found this thread:
https://answers.splunk.com/answers/489938/splunk-add-on-for-microsoft-windows-why-is-timesta.html
It seems to be the answer for your question. Unfortunately the timestamp for WinEventLog is parsed at input time, and cannot be corrected later on at indexs time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi. Did you find out why your parsing for WinEventLog doen't extract the milliseconds? I seem to have the same problem. I've sat TIME_FORMAT in props.conf, but still it seems to be ignored. Also I've checked using the data onboarding UI in Splunk that the TIME_FORMAT setting is indeed correct for the logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does you WinEventLog have milliseconds in the timestamp?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I downvoted this post because this is not an answer. this prevented others from looking into the question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, this is that format => %Y-%m-%dT%H:%M:%S.%9NZ
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so if you do index=windows| table _raw You also see the milliseconds in the message?
how do you collect the Wineventlog? "normal" or by xml?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We collect them in xml format.
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
