topic Could not use srptime to parse timestamp in Getting Data In

Could not use srptime to parse timestamp

sathiyasun — Mon, 27 Aug 2018 19:03:08 GMT

Have been getting "Could not use srptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime. Please advice.

Log:-

INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:



      <web:CreateRecord>

Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)(\w+\:\w+\s\w+\s\=\s\w+\:\d+\-\d+\-\d+\s\d+\:\d+\:\d+\,\d+)
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT= %H-%m-%d %H:%M:%S,3N
TIME_PREFIX=\s
disabled=false
pulldown_type=true

Re: Could not use srptime to parse timestamp

mstjohn_splunk — Mon, 27 Aug 2018 19:30:59 GMT

Hi @sathiyasun,

Are you sure it was "srptime" and not "strptime?"

Just wanted to make sure, because I couldn't find any documentation for the "srptime," but found this for "strptime."

Re: Could not use srptime to parse timestamp

sathiyasun — Mon, 27 Aug 2018 19:31:15 GMT

Trying to beak the line (INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382)