How can we resolve this Data Quality_Issue?

jackin — Thu, 04 May 2023 18:12:43 GMT

We are facing data quality issue
Sample internal log:
WARN messages in splunkd logs as follows DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event (Thu May 4 13:02:33 2023).

I saw some different kind of logs are reporting to production splunk
Sample log of production:
++++++++++++++++++++++++++++++++++++++++++++++++
+ New app 'esign-ec-api' +
++++++++++++++++++++++++++++++++++++++++++++++
+ Initializing app 'esign-ec-api' +
++++++++++++++++++++++++++++++++++++++++++++++
Pinging the JVM took 7 seconds to respond.
++++++++++++++++++++++++++++++++++++++++++++++
+ starting app 'esign-ec-api' +
++++++++++++++++++++++++++++++++++++++++++++++

[props]

Charset=UTF-8

TIME_PREFIX=^\w{4,7}\s+

TIME_FORMAT=%Y-%m-%d %H.%M.%S,%3N

MAX_TIMESTAMP_LOOKAHEAD=40

SHOULD_LINEMERGE=false

NO_BINARY_CHECK=true

TRUNCATE=50000

Pulldown_Type=True

LINE_BREAKER=([\r\n])\w+\s+\d+\-\d+\-\d+\s\d+\:\d+\:\d+

EXTRACT-field1=regex

EXTRACT-field2=regex

Thank You

Re: How can we resolve this Data Quality_Issue?

isoutamo — Thu, 04 May 2023 19:06:58 GMT

if that first part is your event, then it haven’t any timestamp. For that reason your props.conf cannot match it.

r. Ismo

Re: How can we resolve this Data Quality_Issue?

jackin — Fri, 05 May 2023 07:23:28 GMT

How to avoid this kind of log from ingestion ?

topic Re: How can we resolve this Data Quality_Issue? in Splunk Cloud Platform

How can we resolve this Data Quality_Issue?

Re: How can we resolve this Data Quality_Issue?

Re: How can we resolve this Data Quality_Issue?