topic Re: timestamp parsing issue for a specific time in Splunk Search

timestamp parsing issue for a specific time

kteng2024 — Tue, 29 Sep 2020 12:57:45 GMT

my log is:

2016-12-22 00:01:11,076 [myid:123] - INFO [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] - Accepted data from

in the props:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

but i am still getting this error " failed to parse the timestamp" . after increasing the lookahead value , this error was disappeared for some time and it started to come back again. can anyone please help me to figure out what might be the issue .

Re: timestamp parsing issue for a specific time

somesoni2 — Tue, 29 Sep 2020 12:57:48 GMT

MAX_TIMESTAMP_LOOKAHEAD value should be 23, length of timestamp.

Re: timestamp parsing issue for a specific time

woodcock — Thu, 23 Feb 2017 07:28:03 GMT

The length of the timestamp is 23 characters, not 30, so you need:

MAX_TIMESTAMP_LOOKAHEAD = 23

Re: timestamp parsing issue for a specific time

kteng2024 — Thu, 23 Feb 2017 20:01:14 GMT

i added the buffer of 7 .

Re: timestamp parsing issue for a specific time

woodcock — Sat, 25 Mar 2017 10:43:10 GMT

Don't do that.

Re: timestamp parsing issue for a specific time

woodcock — Sat, 25 Mar 2017 10:43:16 GMT

You are going to have to find the events that are different that what you are expecting. Start by searching broadly and using the Patterns tab and the punct field to discern differences in log structure.