topic Re: timestamp strftime issues in Splunk Enterprise

timestamp strftime issues

walsborn — Thu, 28 Oct 2021 23:16:57 GMT

Hi all,

I keep getting "DateParserVerbose [6827 merging] - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (75) characters of event. Defaulting to timestamp of previous event" warnings.

The time stamp in the logs looks like: 2021/10/28T16:06:08.183-07:00

props.conf looks like:

DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = true
MAX_TIMESTAMP_LOOKAHEAD = 75
MAX_DAYS_AGO = 36500
MAX_DAYS_HENCE = 36500
TIME_FORMAT = %d-%b-%y %I.%M.%S.%6Q %p
SHOULD_LINEMERGE = false
TRUNCATE = 500000

Anyone know what my time_format should be instead?

Re: timestamp strftime issues

richgalloway — Fri, 29 Oct 2021 00:14:22 GMT

That TIME_FORMAT isn't even close so it' s no wonder Splunk is confused. Try this one.

TIME_FORMAT = %Y/%m/%dT%H:%M:%S.%3N%:z

See https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Commontimeformatvariables for the metacharacters used in TIME_FORMAT.

Re: timestamp strftime issues

walsborn — Fri, 29 Oct 2021 14:33:33 GMT

Yeah I don't know what I'm doing, but thanks for pointing that out. I appreciate the untactful assist.