24hour timestamps parse incorrectly

mcafeesecure — Tue, 15 May 2012 22:07:57 GMT

I have a subset of servers that all of their logs parse the timestamps incorrectly at 12 (noon)..

sample log lines:

CORRECTLY PARSED:

The following all index into splunk as 12PM

May 14 12:00:31 dnv-scan001.scanalert.com resin_stdout: : [12:00:31.153] [SCAN_QUEUE ][WARN ]SaScanQueueServlet: Finished (4ms)
May 14 12:00:56 dnv-scan001.scanalert.com resin_stdout: : [12:00:56.492] [MEMORY ][WARN ]AppMem=25295248 TotalMem=62128128
May 14 12:00:56 dnv-scan001.scanalert.com resin_stdout: : [12:00:56.494] [SCAN_SEND ][WARN ]SaCronSendCompletedServlet: Finished (342ms)

PARSED INCORRECTLY

The following all index into splunk as 12AM

May 14 12:00:02 am1-scan001.scanalert.com resin_stdout: : [12:00:01.605] [MEMORY     ][WARN ]AppMem=26510144 TotalMem=69664768
May 14 12:00:31 am1-scan001.scanalert.com resin_stdout: : [12:00:31.624] [SCAN_QUEUE ][WARN ]SaScanQueueServlet: Finished (7ms)
May 14 12:00:51 am1-scan001.scanalert.com resin_stdout: : [12:00:51.622] [SCAN_SEND  ][WARN ]SaCronSendCompletedServlet: Finished (0ms)

I have a subset of 17 servers, that parse incorrectly, the ONLY difference I can find is the hostnames.

has anyone encountered this behavior, and have any idea if there is a fix around this?
All logs are in 24HR format fo "midnight" hour shows as 00:00:00, while "noon" as 12:00:00

Re: 24hour timestamps parse incorrectly

mcafeesecure — Mon, 28 Sep 2020 11:49:43 GMT

This turned out to be a simple oversight. It seems that the parser was picking up the "am" from the begining of my hostname in the next field. Hence only happening on machines names "am....."

Fix =
Add the following to my stanza's in props.conf

MAX_TIMESTAMP_LOOKAHEAD = 15

topic Re: 24hour timestamps parse incorrectly in Getting Data In

24hour timestamps parse incorrectly

Re: 24hour timestamps parse incorrectly