Possible bug in Monitoring Console (Indexing->Inputs-Data Quality->Timestamp Parsing issues)

Azeemering — Mon, 22 Jan 2018 11:47:41 GMT

Hi,

I have a logfile that generates exceptions. When there is no exception it just generates event lines with a header and a footer.
These events without a timestamp generate timestamp parsing issues as expected.
This is shown in the MC-->ndexing->Inputs-Data Quality->Timestamp Parsing issues.

All correct so far....

So I have created a props and transforms to send these garbage header and footer events to the nullqueue. This works fine.
When I now search for this sourcetype the garbage events do no show up anymore. Exactly what I want....
But in the Monitoring Console this sourcetype / header footer garbage events still generate timestamp parsing issues.
I think this is a bug in Splunk?

topic Possible bug in Monitoring Console (Indexing->Inputs-Data Quality->Timestamp Parsing issues) in Getting Data In

Possible bug in Monitoring Console (Indexing->Inputs-Data Quality->Timestamp Parsing issues)