Anyone getting this error? DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128)

[np_hwp]

Have anyone gotten this error message after installation, and can point me to a direction to resolve it?

WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Tue Dec 17 14:01:08 2019). Context: source=/opt/Firepower/splunk/etc/apps/TA-eStreamer|host=splumkhf.domain.com|cisco:estreamer:data|83258

[jmantor]

IS there a fix for this? I'm running 3.5.8 and seeing a lot of these warnings

[jsfennell]

Just tracked down this same issue, the "cisco:estreamer:data" sourcetype is expecting the event_sec field for timestamp. There are a number of events that do not contain that field.

sourcetype="cisco:estreamer:data" NOT event_sec="*"

Also, this addon needs reworking to handle the FIELDALIAS behavior changes after 7.2.4
https://docs.splunk.com/Documentation/Splunk/8.0.1/ReleaseNotes/Fieldaliasbehaviorchange

[woodcock]

You are not following best-practices and using the Magic 8:
https://www.sicherevielfalt.de/blog/the-ultimate-splunk-magic-8-for-a-dramatic-performance-boost/

[codebuilder]

This means that Splunk is not finding the timestamp in your event where it is expecting to find it.
Or, it is not in the format expected and is being 'overlooked'.

All settings related to this can be found within props.conf, and could be one of several...
DATETIME_CONFIG
TIME_PREFIX
TIME_FORMAT

I would suggest you manually upload some sample events via the web UI, apply the sourcetype and preview the results. This should show you what is going wrong the the date/time extraction.