This is possible, but this approach requires a datamodel amendment. If an ordinary search of the index showed timestamps with sub-seconds: but the equivalent tstats search did not: the workaround is to modify the datamodel to add another field which takes a copy of the full timestamp. That additional field can either be retained like other fields or can be used to reinstate the timestamp with sub-second detail. For example, create a calculated field “time_millis” that just takes a copy of _time. Now, if you return to your tstats search from earlier and include time_millis, you can display time_millis and/or use it to reinstate the milliseconds of the _time field (i.e. | eval _time=time_miilis):
... View more