All Apps and Add-ons

Help with time parsing error using GitLab Add-on.

jgbricker
Contributor

Please assist with what appears to be a date/time parsing issue:

Splunk Enterprise 7.3.1.

Python version info --

$ /opt/splunk/bin/splunk cmd python
Python 2.7.15 (default, Jun 24 2019, 17:39:18)
[GCC 5.3.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.

ERROR log events after setting up and restarting Splunk to collect data for a specified project ID:

05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py" Traceback (most recent call last):
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"   File "/opt/splunk/etc/apps/TA-gitlab-add-on/bin/ta_gitlab_add_on/modinput_wrapper/base_modinput.py", line 127, in stream_events
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"     self.collect_events(ew)
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"   File "/opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py", line 72, in collect_events
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"     input_module.collect_events(self, ew)
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"   File "/opt/splunk/etc/apps/TA-gitlab-add-on/bin/input_module_get_events.py", line 203, in collect_events
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"     if (datetime.strptime(r_loop['created_at'], '%Y-%m-%dT%H:%M:%S.%fZ')
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"   File "/opt/splunk/lib/python2.7/_strptime.py", line 332, in _strptime
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py"     (data_string, format))
05-19-2020 14:10:46.781 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-gitlab-add-on/bin/get_events.py" ValueError: time data '2020-02-24T12:48:08.608-05:00' does not match format '%Y-%m-%dT%H:%M:%S.%fZ'
0 Karma

jgbricker
Contributor

It seems like the following post is related -- https://stackoverflow.com/questions/41684991/datetime-strptime-2017-01-12t141206-000-0500-y-m-dthms-...

Hoping the developer can review this post and offer a suggested edit to 'input_module_get_events.py' or the appropriate script.

Thanks in advance

-jB

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...