https://github.com/timberio/vector/blob/master/src/sinks/splunk_hec.rs#L122-L124:
let timestamp = if let Some(Value::Timestamp(ts)) =
event.remove(&event::log_schema().timestamp_key())
{
ts.timestamp()
} else {
chrono::Utc::now().timestamp()
};
timestamp() returns a second-precision i64 whereas Splunk will accept nanosecond-precision Unix timestamp. As a result of this call timestamp precision is reduced to second.
@LucioFranco it looks like you wrote this line. Do you have any context on why you chose second precision? And do you know if this is a problem across other sinks?
Thanks @lewisthompson, we'll prioritize this and get it fixed this week.
Most helpful comment
Thanks @lewisthompson, we'll prioritize this and get it fixed this week.