I have below logs.
Wed May 15 13:00:00.4 ... (*it is 4miliseconds)
Wed May 15 13:00:00.82 ... (*it is 82miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110miliseconds)
But these logs's timestamp are extracted like below.
2019 5/15 13:00:00.400 ... (*actually, it is 4miliseconds)
2019 5/15 13:00:00.820 ... (*actually, it is 82miliseconds)
2019 5/15 13:00:00.110 ... (*actually, it is 110miliseconds)
Is there workaround to extract such timestamps in right way?
If someone know about it, please tell me.
Thank you.
The problem is actually in how milliseconds work, not in how Splunk works. For your examples:
Wed May 15 13:00:00.4 ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82 ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
Going the other way:
Wed May 15 13:00:00.004 ... (*it is 4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is 82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
So almost certainly everything is A-OK.
The problem is actually in how milliseconds work, not in how Splunk works. For your examples:
Wed May 15 13:00:00.4 ... (*it is 400 miliseconds)
Wed May 15 13:00:00.82 ... (*it is 820 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
Going the other way:
Wed May 15 13:00:00.004 ... (*it is 4 miliseconds)
Wed May 15 13:00:00.082 ... (*it is 82 miliseconds)
Wed May 15 13:00:00.110 ... (*it is 110 miliseconds)
So almost certainly everything is A-OK.
Is this timestamp from Database using DB Connect ?