Getting Data In

How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

saifuddin9122
Path Finder

Hello

i have a time stamp as [17/Oct/2016:16:09:51 +0000] and my props.conf looks like:

TIME_PREFIX = \[
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %Y/%b/%d:%H:%M:%S +0000

when i do this, i am getting error: Could not use strptime to parse timestamp from "[17/Oct/2016:16:09:51 +0000]"

can anyone let me know where is my mistake???

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You transposed some characters in the TIME_FORMAT attribute. Try %d/%b/%Y:%H:%M:%S +0000.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gokadroid
Motivator

I notice you have got it other way around, your timeformat should actually be %d/%b/%Y:%H:%M:%S +0000 whereas you have %Y/%b/%d:%H:%M:%S +0000 based on the sample date you have pasted.

Can you also try to remove +0000 from the TIME_FORMAT if first option doesn't seem to fix your issue and see if it helps.

Hope that helps resolving it.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...