Splunk Is not Extracting Milliseconds from the Events

Available Languages

Updated:September 28, 2026
Document ID:SPLK044407

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

Splunk extracts up to the seconds and ignores the millisecond events when the events contain them. This rounding results in a sorting of the logs in the Splunk searches which does not correspond to the time order of generation of the logs, which could be problematic for reports and some event uses.

Investigation

The following can be reproduced to help diagnose the error in the extraction:
  1. props.conf was properly configured to extract the milliseconds, for example: 
    TIME_FORMAT =%Y%m%dT%H:%M:%S.%9N%Z
  2. Events are ingested using HEC(HTTP Event Collector).
  3. The endpoint used to send the events is /collector/event: 
    https://host_name/services/collector/event

Resolution

Change the endpoint, from event to raw: 
https://host_name/services/collector/raw

Splunk Answers:

Defining timestamp for hec input

Splunk Documentation:

Raw event parsing
Format events for HTTP Event Collector: Raw event parsing

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products