Getting Data In

DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

nathanlhopkins
Path Finder

In my Splunkd log for one of our webspheres I'm finding multiple entries with;

DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event ...

Please can anyone advise what might be the fix for this?

Do I need to create my own sourcetype? with props.conf?

Tags (2)

DavidLago
New Member

Just insert this line inside your props sourcetype section:

DATETIME_CONFIG = CURRENT
0 Karma

kml_uvce
Builder

your timestamp extraction not working properly, make changes in props.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

-Kamal Bisht

kamal singh bisht

Michael
Contributor

geez, how I love RTFM answers...

0 Karma

nathanlhopkins
Path Finder

When I use data preview - should I see the issue? Are the green values highlighted the problem or a good match on timestamp?

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...