topic Re: Splunk Cisco encore Events with no Timestamp in Getting Data In

Splunk Cisco encore Events with no Timestamp

b17gunnr — Mon, 25 Aug 2025 22:16:15 GMT

Hello friends,

Splunk is cranky with errors stating: Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event. This is related to my Cisco estreamer ingest and there are no timestamps in any of the events.

Is there a way to tell the Indexer that there are no timestamps, that it should not use the lookahead, and configure the index time as the event time for the specific index and sourcetype?

Thank you.

Re: Splunk Cisco encore Events with no Timestamp

PrewinThomas — Tue, 26 Aug 2025 04:20:46 GMT

@b17gunnr

If you want Splunk to stop searching for timestamps, just go to your Indexer or Heavy Forwarder (whichever is doing the parsing) and update the props.conf for the relevant sourcetype

Eg:

[your_sourcetype] DATETIME_CONFIG = NONE SHOULD_LINEMERGE = false NO_BINARY_CHECK = true

Tells Splunk not to attempt timestamp extraction. It will use the index time as the event time

Note: Are you using any specific add-on for this?

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Splunk Cisco encore Events with no Timestamp

livehybrid — Tue, 26 Aug 2025 05:33:17 GMT

Hi @b17gunnr

The Cisco Firepower app in Splunkbase doesnt have a props.conf to tell Splunk how to process timestamps so you will need to create a props.conf in the appropriate place and deploy out as per your other apps to the server that the data is parsed on (either Heavy Forwarder or Indexer(s)) - this will tell Splunk to use the receipt time:

Set DATETIME_CONFIG = NONE to prevent the timestamp processor from running. When timestamp processing is off, Splunk Enterprise does not look at the text of the event for the timestamp and instead uses the event time of receipt, the time the event arrives through its input. For file-based inputs, the event timestamp is taken from from the modification time of the input file. Set DATETIME_CONFIG = CURRENT to assign the current system time to each event as Splunk Enterprise indexes it.

For more info check out https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-timestamps/configure-timestamp-recognition#:~:text=Set%20DATETIME_CONFIG%20%3D%20NONE,Enterprise%20indexes%20it.

# props.conf - Update sourcetypes accordingly [cisco:estreamer:log] DATETIME_CONFIG = NONE [cisco:estreamer:status] DATETIME_CONFIG = NONE [cisco:estreamer:data] DATETIME_CONFIG = NONE

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing