- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- WinEventLog Milli seconds identification.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
WinEventLog Milli seconds identification.
Splunk is not parsing the milliseconds into _time field. How to parse it during the index time?
I have updated my TIME_FORMAT in props in all the search peers; yet it is not parsing properly.
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After looking some more into the problem with Splunk not extracting milliseconds from WinEventLog, I found this thread:
https://answers.splunk.com/answers/489938/splunk-add-on-for-microsoft-windows-why-is-timesta.html
It seems to be the answer for your question. Unfortunately the timestamp for WinEventLog is parsed at input time, and cannot be corrected later on at indexs time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi. Did you find out why your parsing for WinEventLog doen't extract the milliseconds? I seem to have the same problem. I've sat TIME_FORMAT in props.conf, but still it seems to be ignored. Also I've checked using the data onboarding UI in Splunk that the TIME_FORMAT setting is indeed correct for the logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does you WinEventLog have milliseconds in the timestamp?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I downvoted this post because this is not an answer. this prevented others from looking into the question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, this is that format => %Y-%m-%dT%H:%M:%S.%9NZ
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so if you do index=windows| table _raw You also see the milliseconds in the message?
how do you collect the Wineventlog? "normal" or by xml?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We collect them in xml format.
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
