topic Re: Meraki TA - Could not identify datetime field for input in Getting Data In

Meraki TA - Could not identify datetime field for input

Space_Crawler — Mon, 24 Feb 2025 03:29:02 GMT

Hello,

I have a fresh install of splunk and Meraki TA App.

I have configured several inputs in the App, however I am seeing a large number of these error messages under various inputs (for example, appliance_vpn_statuses, appliance_vpn_stats) in the following manner:

2025-02-24 03:12:56,971 WARNING pid=50094 tid=MainThread file=cisco_meraki_connect.py:col_eve:597 | Could not identify datetime field for input: cisco_meraki_appliance_vpn_statuses

Re: Meraki TA - Could not identify datetime field for input

kiran_panchavat — Mon, 24 Feb 2025 07:27:12 GMT

@Space_Crawler

Ensure that the datetime field in your data is correctly formatted and matches the expected format in Splunk.

Verify the "cisco_meraki_appliance_vpn_statuses" input are correctly configured to identify the datetime field

Review the configuration files (e.g., props.conf and transforms.conf) to ensure that the datetime field is properly defined.

Re: Meraki TA - Could not identify datetime field for input

kiran_panchavat — Mon, 24 Feb 2025 07:34:21 GMT

@Space_Crawler

Review the following attributes in props.conf for the configured sourcetypes.

TIME_PREFIX
TIME_FORMAT