Getting Data In

How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

saifuddin9122
Path Finder

Hello

i have a time stamp as [17/Oct/2016:16:09:51 +0000] and my props.conf looks like:

TIME_PREFIX = \[
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %Y/%b/%d:%H:%M:%S +0000

when i do this, i am getting error: Could not use strptime to parse timestamp from "[17/Oct/2016:16:09:51 +0000]"

can anyone let me know where is my mistake???

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You transposed some characters in the TIME_FORMAT attribute. Try %d/%b/%Y:%H:%M:%S +0000.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gokadroid
Motivator

I notice you have got it other way around, your timeformat should actually be %d/%b/%Y:%H:%M:%S +0000 whereas you have %Y/%b/%d:%H:%M:%S +0000 based on the sample date you have pasted.

Can you also try to remove +0000 from the TIME_FORMAT if first option doesn't seem to fix your issue and see if it helps.

Hope that helps resolving it.

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...