Getting Data In
Highlighted

How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

Path Finder

Hello

i have a time stamp as [17/Oct/2016:16:09:51 +0000] and my props.conf looks like:

TIME_PREFIX = \[
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %Y/%b/%d:%H:%M:%S +0000

when i do this, i am getting error: Could not use strptime to parse timestamp from "[17/Oct/2016:16:09:51 +0000]"

can anyone let me know where is my mistake???

0 Karma
Highlighted

Re: How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

Motivator

I notice you have got it other way around, your timeformat should actually be %d/%b/%Y:%H:%M:%S +0000 whereas you have %Y/%b/%d:%H:%M:%S +0000 based on the sample date you have pasted.

Can you also try to remove +0000 from the TIME_FORMAT if first option doesn't seem to fix your issue and see if it helps.

Hope that helps resolving it.

0 Karma
Highlighted

Re: How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

SplunkTrust
SplunkTrust

You transposed some characters in the TIME_FORMAT attribute. Try %d/%b/%Y:%H:%M:%S +0000.

---
If this reply helps you, an upvote would be appreciated.
0 Karma