https://community.splunk.com/t5/Getting-Data-In/How-to-find-events-with-Timestamp-issue/m-p/57358#M11201 <P>If you're on 4.3, by far the easiest way to accomplish this is to use the data preview wizard using a sample log file from the host and sourcetype indicated in the log file. </P> <P>It will assist you in generating the proper props.conf for that input. </P> Thu, 13 Sep 2012 03:54:31 GMT adamw 2012-09-13T03:54:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-events-with-Timestamp-issue/m-p/57357#M11200 <P>I'm seeing the below error in splunkd.log of an indexer</P> <P>WARN DateParserVerbose - Failed to parse timestamp. </P> <P>The error does give me source file, host sourcetype. But it didnt give me the event for which the timestamp fails. </P> <P>Only a fraction of the logs are having issues so im not able to find them.</P> <P>Is there any way to better solve this?</P> Wed, 12 Sep 2012 07:20:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-events-with-Timestamp-issue/m-p/57357#M11200 ma_anand1984 2012-09-12T07:20:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-events-with-Timestamp-issue/m-p/57358#M11201 <P>If you're on 4.3, by far the easiest way to accomplish this is to use the data preview wizard using a sample log file from the host and sourcetype indicated in the log file. </P> <P>It will assist you in generating the proper props.conf for that input. </P> Thu, 13 Sep 2012 03:54:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-events-with-Timestamp-issue/m-p/57358#M11201 adamw 2012-09-13T03:54:31Z