Getting Data In

DateParserVerbose - Failed to parse timestamp

sharada
Loves-to-Learn Everything

Hi Splunkers,

I am facing the below time stamp issues. Could you please help me with this issue.

08-01-2021 22:49:25.563 -0400 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (800) characters of event. Defaulting to timestamp of previous event (Sun Aug 1 22:49:25 2021).

 

[props]

TIME_FORMAT = %m-%d-%Y%H:%M:%S.%3Q
SHOULD_LINEMERGE = False
is_valid = True
maxDist = 9999
BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
MAX_TIMESTAMP_LOOKAHEAD = 800
NO_BINARY_CHECK = true
category = Custom

Labels (2)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @sharada 

Can you replace with following.

 

[props]
TIME_FORMAT = %m-%d-%Y %H:%M:%S.%3Q
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom

 

---

An upvote would be appreciated and Accept solution if this reply helps!

 

 

0 Karma

sharada
Loves-to-Learn Everything

Thanks for your response Venkatasri. I modified the props as you suggested but the issue still appears..

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...