Getting Data In

Creating a sourcetype keeps failing

NanSplk01
Path Finder

I have a sourcetype that I have been trying to break my logs apart, but I keep getting:  Failed to parse timestamp:  Here is an example:

[ logs ]
CHARSET=UTF-8
EVENT_BREAKER_ENABLE=true
LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\,\d{3}
MAX_EVENTS=135000
MAX_TIMESTAMP_LOOKAHEAD=23
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N
TRUNCATE=50000
TZ=America/New_York
disabled=false
pulldown_type=true

 

The logs look like they are broken correctly, but I still keep getting the error about the timestamp.

Here is an example of the logs:

2022-04-25 11:28:17,743 ERROR [148] Method:C1222.MessageProcessor.ProcessResponseMessage -- String[] {Unexpected Exception:
Internal Error - Unable to find Endpoint by ApTitle. - ApTitle: 2.16.124.113620.1.22.0.1.1.64.5541482OldDeviceAddress: x.xx.xxx.xxxxxx.x.xx.x.x.x.xx.xxxxxxx, Internal Error - Unable to find Endpoint by ApTitle.}
Itron.Ami.Common.Logging.AmiException: Internal Error - Unable to find Endpoint by ApTitle.
2022-04-25 11:28:17,759 ERROR [148] Method:C1222.MessageProcessor.ProcessResponseMessage -- Unexpected System Exception: AmiException - Internal Error - Unable to find Endpoint by ApTitle. received - contact Application manager.

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

That seems correct definition except that I propose you to add 

TIME_PREFIX = ^

to splunk start to look timestamp from beginning of event.

Actually length of your timestamp is 24 not 23. So you must increase that

MAX_TIMESTAMP_LOOKAHEAD at least 24, but better add it e.g. 30

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

That seems correct definition except that I propose you to add 

TIME_PREFIX = ^

to splunk start to look timestamp from beginning of event.

Actually length of your timestamp is 24 not 23. So you must increase that

MAX_TIMESTAMP_LOOKAHEAD at least 24, but better add it e.g. 30

r. Ismo

0 Karma

NanSplk01
Path Finder

The solution worked.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...