Getting Data In
Highlighted

How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

Path Finder

Hello

i have a time stamp as [17/Oct/2016:16:09:51 +0000] and my props.conf looks like:

TIME_PREFIX = \[
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %Y/%b/%d:%H:%M:%S +0000

when i do this, i am getting error: Could not use strptime to parse timestamp from "[17/Oct/2016:16:09:51 +0000]"

can anyone let me know where is my mistake???

0 Karma
Highlighted

Re: How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

Motivator

I notice you have got it other way around, your timeformat should actually be %d/%b/%Y:%H:%M:%S +0000 whereas you have %Y/%b/%d:%H:%M:%S +0000 based on the sample date you have pasted.

Can you also try to remove +0000 from the TIME_FORMAT if first option doesn't seem to fix your issue and see if it helps.

Hope that helps resolving it.

0 Karma
Highlighted

Re: How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

SplunkTrust
SplunkTrust

You transposed some characters in the TIME_FORMAT attribute. Try %d/%b/%Y:%H:%M:%S +0000.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.