This is how my WebLogic logs look :
<timestampuntilseconds> <fixed number="" of="" other="" tags="" here=""> <1369087465001> More data here
As you can see, they have a timestamp in the beginning, then they have some other information , then there's the time in milliseconds since 1970 and then there's the rest of the log.
Now, as expected, Splunk takes the first timestamp and ignores what appears to be a random number. But the timestamp is not accurate enough for me, so I would like to store the last three digits of the number as the milliseconds. How would I go about that?