topic Re: How do I fix this : Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD? in Splunk Enterprise

How do I fix this : Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD?

super_saiyan — Thu, 15 Sep 2022 15:11:53 GMT

I've deployed below props to extract the time splunk. There are WARN messages in splunkd logs as follows DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (12) characters of event. Defaulting to timestamp of previous event.

please refer to the below log

Hounsaya add_user 4 Thu Sep 15 10:09 - 26:39 (60+00:47)

Can you please help and let me know if i need to make any changes?

Re: Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD

richgalloway — Thu, 15 Sep 2022 14:06:08 GMT

Please share the props.conf settings for the sorucetype, especially TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD.

Re: How do I fix this : Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD?

super_saiyan — Fri, 16 Sep 2022 04:40:56 GMT

Hi @richgalloway Many thanks for your quick response. Below is my props.conf

TIME_PREFIX = (Sun|Mon|Tue|Wed|Thu|Fri|Sat)\s

TIME_FORMAT = %b %d %H:%M

NO_BINARY_CHECK = true

SHOULD_LINEMERGE = false

Re: How do I fix this : Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD?

richgalloway — Fri, 16 Sep 2022 12:26:41 GMT

That looks like it should work, but here's an alternative to try:

TIME_PREFIX = \d\s+ TIME_FORMAT = %a %b %d %H:%M NO_BINARY_CHECK = true SHOULD_LINEMERGE = false