failed to parse timestamp for event

keiichilam — Mon, 28 Sep 2020 09:56:19 GMT

My splunk failed to parse timestamp of one of the inbound syslog.

10-03-2011 10:55:18.119 +0800 WARN DateParserVerbose - Failed to parse timestamp for event. Context="source::udp:514|host::TSSSYSLOG01|syslog|" Text="172.18.12.21, -, -, N, 2011-10-03, 11:02:45, 1, -, -, ProxyAV_Sec, 172.18.12.25, 1344, 906, 193, 0, ..."

I have renamed the sourcetype as proxyav in transforms.conf

in props.conf, I added follow
[proxyav]

SHOULD_LINEMERGE = false

# MAX_TIMESTAMP_LOOKAHEAD=60

# TIME_PREFIX = ^[^\,]+\,[^\,]+\,[^\,]+\,[^\,]+\,\s

# TIME_FORMAT = %Y-%m-%d, %T

# TIME_PREFIX = ^[^\,]+\,[^\,]+\,[^\,]+\,[^\,]+\,\s

TIME_FORMAT = %Y-%m-%d, %H:%M:%S,

KV_MODE = none

I did also tried various remarked setting, but no luck to remove the parse error. Could anyone give me a hand?

Best Regards

Re: failed to parse timestamp for event

mzorzi — Mon, 03 Oct 2011 08:47:31 GMT

You should use the TIME_PREFIX, instead of ^[^,], I would use a regex for the ip, then a non space, like \S

topic Re: failed to parse timestamp for event in Getting Data In

failed to parse timestamp for event

Re: failed to parse timestamp for event