https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35616#M6496 <P>When I use data preview - should I see the issue? Are the green values highlighted the problem or a good match on timestamp?</P> Thu, 16 May 2013 14:18:48 GMT nathanlhopkins 2013-05-16T14:18:48Z https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35614#M6494 <P>In my Splunkd log for one of our webspheres I'm finding multiple entries with;</P> <P>DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event ...</P> <P>Please can anyone advise what might be the fix for this?</P> <P>Do I need to create my own sourcetype? with props.conf?</P> Wed, 15 May 2013 22:50:20 GMT https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35614#M6494 nathanlhopkins 2013-05-15T22:50:20Z https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35615#M6495 <P>your timestamp extraction not working properly, make changes in props.conf <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A></P> <P>-Kamal Bisht</P> Thu, 16 May 2013 03:59:44 GMT https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35615#M6495 kml_uvce 2013-05-16T03:59:44Z https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35616#M6496 <P>When I use data preview - should I see the issue? Are the green values highlighted the problem or a good match on timestamp?</P> Thu, 16 May 2013 14:18:48 GMT https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35616#M6496 nathanlhopkins 2013-05-16T14:18:48Z https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35617#M6497 <P>geez, how I love RTFM answers...</P> Wed, 30 Nov 2016 20:43:21 GMT https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35617#M6497 Michael 2016-11-30T20:43:21Z https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35618#M6498 <P>Just insert this line inside your props sourcetype section:</P> <PRE><CODE>DATETIME_CONFIG = CURRENT </CODE></PRE> Wed, 03 May 2017 16:35:49 GMT https://community.splunk.com/t5/Getting-Data-In/DateParserVerbose-Failed-to-parse-timestamp-Defaulting-to/m-p/35618#M6498 DavidLago 2017-05-03T16:35:49Z