Help with writing props, keep getting error?

jackin — Mon, 06 Mar 2023 14:21:04 GMT

I have below logs

Status: INFORMATION: Description: Beginning GDP Fransaction Script: 01-22-2023-01-13-04-PM

Status: INFORMATION: Description: txt file already exists

Status: INFORMATION: Description: csv file already exists

Status: OK: Description: C:\GDPFransactionScript\Inputs \GDPTestFile.csv copy to USB successful

Status: OK: Description: C:\GDPTransactionScript\Inputs \GDPTestFile.txt copy to USB successful

Status: ERROR: Description: http POST failed:

Status: ERROR: Description: https POST failed:

Status: INFORMATION: Description: End of GDP Transaction Script: 01-22-2023-01-13-04-PM

I have mentioned in my props

CHARSET=AUTO

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)\Status

NO_BINARY_CHECK=true

disabled=false

TIME_PREFIX=^

But i am seeing error like failed to parse timestamp. Default to file modtime

How to resolve this issue

Re: Need assistance in writing props

richgalloway — Fri, 03 Mar 2023 15:19:09 GMT

Most of the example events do not contain a timestamp so Splunk has to use the file mod-time or the current time. To use the current time, specify DATETIME_CONFIG = CURRENT.

Perhaps those lines are a single event. If so, then try these settings

SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)Status INFORMATION: Description: Beginning NO_BINARY_CHECK = true disabled = false TIME_PREFIX = Script: TIME_FORMAT = %m-%d-%Y-%I:%M:%S-%p

topic Help with writing props, keep getting error? in Splunk Cloud Platform

Help with writing props, keep getting error?

Re: Need assistance in writing props