How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”?

Hemnaath — Thu, 26 May 2022 18:38:02 GMT

Hi All,

I am trying to built the parsing stanza for one of the data, while testing I am getting an pop-up message stating that "could not use the strptime to parse timestamp from “2022-26-05T11:29:57”.

As soon as I apply the Time_Format stanza the Splunk is throwing the message. I am not sure what I am missing here. so could you please help me resolving this issue.

Event details:

Props stanza

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\<Event
NO_BINARY_CHECK=true
TIME_PREFIX=dtPostTime\=\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=20

Event Details:

[5/26/2022 4:09:55 PM UTC] Note: Unknown provider type; cannot verify object name 'tbl_BaseJobInfo' valid for data store.

Props.conf

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\[\d+\/\d{2}\/\d{4}\s\d+\:\d{2}\:\d{2}\s[^\]]+\]
NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^\[
TIME_FORMAT=%m-%d-%Y %I:%M:%S %p %s
MAX_TIMESTAMP_LOOKAHEAD=25

Re: How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”

ITWhisperer — Thu, 26 May 2022 18:28:17 GMT

I am not sure if this is your problem but, from the event, it looks like the second time format should be

TIME_FORMAT=%m/%d/%Y %I:%M:%S %p %s

topic How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”? in Getting Data In

How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”?

Re: How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”