topic Re: failed to parse timestamp at data preview in Getting Data In

failed to parse timestamp at data preview

newbiesplunk — Tue, 02 Sep 2014 06:39:29 GMT

Hi,
When i do the data preview, it stated "Failed to parse timestamp, defaulting to file modetime". The correct timestamp for my event should be 2 Sep instead of 9 Feb. How to resolve it? If it due to the date configured at the server end or the setting at the splunk? thks

Re: failed to parse timestamp at data preview

tom_frotscher — Tue, 02 Sep 2014 07:23:43 GMT

Hi! Splunk can't automatically resolve your timestamp in this case. Therefore, it can fall back to use the time of the last modification of your logfile as a timestamp. If this is the case, you need to do some additional configuration. Is it possible that you post some example events of your logfile and show us the configuration you use for the corresponding sourcetype? Then we can help you to make splunk considering your timestamp correctly.

Re: failed to parse timestamp at data preview

newbiesplunk — Thu, 02 Oct 2014 08:15:10 GMT

Hi,
if i would like to extract the date (dd/mm/yyyy hh:mm:ss) in the content of the file as the timestamp as shown below, how to go abt doing it? thks

File content
Start;server;02/10/2014 16:13:13