topic Re: Value misinterpreted as time in Getting Data In

Value misinterpreted as time

amielke — Thu, 24 Jan 2019 16:05:16 GMT

We found the following message in the data and Splunk recognizes it as a timestamp. How can I prevent this interpretation and add it to the event before it?

parameters: :I1:=1109002298;

thx

Re: Value misinterpreted as time

nickhills — Thu, 24 Jan 2019 16:14:38 GMT

Your best bet is to configure a specific timestamp lookahead/format and event break options.
To give you a bit more help are you able to share a few complete events?

Re: Value misinterpreted as time

amielke — Thu, 24 Jan 2019 16:19:55 GMT

This is the full event:

2018-12-14 09:01:42,793
statement:
SELECT t0.id,t0.name1 FROM DUMMY t0, DUMMY2 t1
 WHERE (t0.id = :I1) AND (t1.id = t0.id
)
parameters: :I1:=1109002298;
CPL Stacktrace - Start ...
CPL Stacktrace - End

2018-12-14 09:01:43,793
NEW EVENT

Re: Value misinterpreted as time

nickhills — Thu, 24 Jan 2019 16:35:28 GMT

In props.conf add the following to the stanza for your sourcetype.

TIME_FORMAT = %Y-%m-%d %H:%M:%S,%L

Re: Value misinterpreted as time

amielke — Thu, 24 Jan 2019 16:45:24 GMT

We try "TIME_FORMAT", but:
The logfile has a second eventtype included (unordered mix 😞 😞

********** first log of session at 2018-12-14 09:31:42,793
message
*********

In this case only the timestamp upstairs is found, not the second time (*** first log of...) format.

If we not use the "TIME_FORMAT", splunk regognize both timeformats and the unwanted value.

Re: Value misinterpreted as time

nickhills — Thu, 24 Jan 2019 16:49:29 GMT

In that case 🙂
Use this:

MAX_TIMESTAMP_LOOKAHEAD = 24
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%L

Re: Value misinterpreted as time

amielke — Fri, 25 Jan 2019 08:40:06 GMT

We found a solution for us:

[your_sourcetype]
BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
DATETIME_CONFIG =
LINE_BREAKER = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true

Re: Value misinterpreted as time

woodcock — Fri, 25 Jan 2019 22:44:06 GMT

Never, ever let splunk guess time details. Use these props.conf settings:

[YourSourcetypeHere]
TIME_PREFIX = 
TIME_FORMAT = 
MAX_TIMESTAMP_LOOKAHEAD =