https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241230#M46811 <P>Thank you!</P> Fri, 18 Nov 2016 21:26:56 GMT babcolee 2016-11-18T21:26:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241228#M46809 <P>I have an Ironport log file that looks like the following:</P> <PRE><CODE>Thu Nov 17 16:11:20 2016 Info: MID 123456789 ICID 123456789 To: Rejected by Receiving Control Thu Nov 17 16:11:20 2016 Info: MID 123456789 queued for delivery Thu Nov 17 16:11:20 2016 Info: MID 123456789 Outbreak Filters: verdict negative Thu Nov 17 16:11:20 2016 Info: Message finished MID 123456789 aborted Thu Nov 17 16:11:20 2016 Info: Message aborted MID 123456789 Receiving aborted by sender </CODE></PRE> <P>I have configured the props.conf on the indexer under the /opt/splunk/etc/system/local as the following but I am still getting the "Failed to parse timestamp" errors. </P> <PRE><CODE>[source::/var/log/proxy/ironport/*/mail.*@*.s] SHOULD_LINEMERGE = false TIME_FORMAT = %a %b %_d %H:%M:%S %Y TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 25 </CODE></PRE> <P>The full error message is </P> <PRE><CODE>11-17-2016 17:09:58.593 +0000 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Thu Nov 17 16:22:07 2016). Context: source::/var/log/proxy/ironport/mail.text.mariner.yyy.corp.com.@20161117T162003.s|host::xxxxxslg01.xxxx.company.com|cisco_esa|376273 </CODE></PRE> Thu, 17 Nov 2016 17:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241228#M46809 babcolee 2016-11-17T17:14:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241229#M46810 <P>Remove the time_format and time_prefix settings. Splunk will read that timestamp correctly. I copied/pasted your log data into a file, uploaded it, and timestamps were extracted auto-magically.</P> Tue, 29 Sep 2020 11:50:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241229#M46810 sshelly_splunk 2020-09-29T11:50:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241230#M46811 <P>Thank you!</P> Fri, 18 Nov 2016 21:26:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241230#M46811 babcolee 2016-11-18T21:26:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241231#M46812 <P>It seemed to be working for awhile but I am seeing the same message again</P> Mon, 28 Nov 2016 20:19:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241231#M46812 babcolee 2016-11-28T20:19:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241232#M46813 <P>I just realized this is still out there. Sorry I missed that.<BR /> Have you seen: <BR /> <A href="http://wiki.splunk.com/Set_up_Splunk_for_Cisco_IronPort_Web_Security_Appliance" target="_blank">http://wiki.splunk.com/Set_up_Splunk_for_Cisco_IronPort_Web_Security_Appliance</A><BR /> This might be the easiest thing to do, as Cisco_WSA_squid is a known sourcetype, and should make you life alot easier.</P> Tue, 29 Sep 2020 12:00:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241232#M46813 sshelly_splunk 2020-09-29T12:00:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241233#M46814 <P>We have already configured the Ironport feeds with a rename of the sourcetype to cisco:esa:legacy and linked it to the CIM model so any change is not possible. I have approached Splunk Support and they have referred me back to Splunk Answers since this is not a break fix. However, this is not working as prescribed so we are looking for some help to resolve this issue</P> Wed, 30 Nov 2016 14:21:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-a-quot-DateParserVerbose-Failed-to-parse/m-p/241233#M46814 babcolee 2016-11-30T14:21:54Z