Getting Data In

How to edit props.conf to resolve "Could not use strptime to parse timestamp" error?

saifuddin9122
Path Finder

Hello

i have a time stamp as [17/Oct/2016:16:09:51 +0000] and my props.conf looks like:

TIME_PREFIX = \[
MAX_TIMESTAMP_LOOKAHEAD = 26
TIME_FORMAT = %Y/%b/%d:%H:%M:%S +0000

when i do this, i am getting error: Could not use strptime to parse timestamp from "[17/Oct/2016:16:09:51 +0000]"

can anyone let me know where is my mistake???

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You transposed some characters in the TIME_FORMAT attribute. Try %d/%b/%Y:%H:%M:%S +0000.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gokadroid
Motivator

I notice you have got it other way around, your timeformat should actually be %d/%b/%Y:%H:%M:%S +0000 whereas you have %Y/%b/%d:%H:%M:%S +0000 based on the sample date you have pasted.

Can you also try to remove +0000 from the TIME_FORMAT if first option doesn't seem to fix your issue and see if it helps.

Hope that helps resolving it.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...