topic Timestamp error: “Failed to parse timestamp. Defaulting to file modtime. in Getting Data In

Timestamp error: “Failed to parse timestamp. Defaulting to file modtime.

s1j1yem1x — Fri, 20 Sep 2019 23:17:36 GMT

I want to monitor WindowsUpdate.log on windows PC, after selecting the data source, I got a flagged message saying “Failed to parse timestamp. Defaulting to file modtime. How can I resolve this error? Thank you.

Re: Timestamp error: “Failed to parse timestamp. Defaulting to file modtime.

richgalloway — Sat, 21 Sep 2019 12:46:49 GMT

Either your data does not contain timestamps or the timestamps are in an unexpected location/format. If the former, you'll have to live with the message; if the latter, correct the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD settings in your props.conf file.

Re: Timestamp error: “Failed to parse timestamp. Defaulting to file modtime.

s1j1yem1x — Wed, 30 Sep 2020 02:19:27 GMT

@richgalloway, thanks for your response. I see about 6 props.conf... which one am I supposed to modify and what exactly am I supposed to correct the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD settings to?

I'm a newbie learning splunk. Thank you.

Thank you.

Re: Timestamp error: “Failed to parse timestamp. Defaulting to file modtime.

richgalloway — Mon, 23 Sep 2019 02:27:03 GMT

None of those. Choose Splunk\etc\system\local. Even better is Splunk\etc\apps\<myapp>\local (create it if it doesn't exist). Create a stanza that matches the sourcetype of your data. The exact value of the settings depends on your data. Please share a sample.