Getting Data In

ADD_EXTRA_TIME_FIELDS=false leads to missing milliseconds

exmuzzy
Explorer

I have such props.conf

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result

And events like

2017-11-01 10:38:01,814 [20    ] 
----------------------------
requestID=Server&1509521881805-1676215
messageID=MetroRequest@1509521881806-1029061
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.009
cardUID=04666B4AC34C80
cardNumber=0014175389
trxID=171100000226854667
trxPCID=72000DBDCC267407DB021DA042E4B268
session=136597463

And splunk recognize milliseconds until I add in my props.conf
ADD_EXTRA_TIME_FIELDS = false

After this every events apperars with time with zero milliseconds

0 Karma

ekost
Splunk Employee
Splunk Employee

In Splunk Enterprise 7.0.0 through 7.2.x, the configuration ADD_EXTRA_TIME_FIELDS also controls the extraction of sub-second timestamps in events. If you set ADD_EXTRA_TIME_FIELDS to false, you prevent sub-second extractions and the creation of time_* fields. See: Enhanced strptime() support.

In Splunk Enterprise 7.3.0 and later, a third setting was created for the ADD_EXTRA_TIME_FIELDS configuration that allows the extraction sub-second timestamps in events while blocking the creation of additional time_* fields. See: Timestamp extraction configuration in props.conf.

0 Karma

DalJeanis
Legend

Tell it your specific time format and see if it straightens up.

TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q 
0 Karma

exmuzzy
Explorer

I added it, but it doesn't work
milliseconds still missing

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result
ADD_EXTRA_TIME_FIELDS = false
TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...