How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”?

[Hemnaath]

Hi All,

I am trying to built the parsing stanza for one of the data, while testing I am getting an pop-up message stating that "could not use the strptime to parse timestamp from “2022-26-05T11:29:57”.

  As soon as I apply the Time_Format stanza the Splunk is throwing the message.  I am not sure what I am missing here.  so could you please help me resolving this issue.

Event details:

<Event CompactMode="1" sEventType="OpResult" dwBasicEventType="9" dwAppSpecificEventID="5000" sEventID="EVENT_ID_SCHEDULER_STARTED" sOriginatingApplicationName="RED Identity Management Console" sOriginatingApplicationComponent="Scheduler" sOriginatingApplicationVersion="5.5.3.0" sOriginatingSystem="XXXXXXXXXXXXX" sOriginatingAccount="XXXX\XXXXX" dtPostTime="2022-26-05T11:29:57" sMessage="RED Identity Management Console (running as user XXXX\XXXXX) on system XXXXXXXXXXXXX; - background processor started"/>

Props stanza

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\<Event
NO_BINARY_CHECK=true
TIME_PREFIX=dtPostTime\=\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=20

Event Details:

[5/26/2022 4:09:55 PM UTC] Note: Unknown provider type; cannot verify object name 'tbl_BaseJobInfo' valid for data store.

Props.conf

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\[\d+\/\d{2}\/\d{4}\s\d+\:\d{2}\:\d{2}\s[^\]]+\]
NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^\[
TIME_FORMAT=%m-%d-%Y %I:%M:%S %p %s
MAX_TIMESTAMP_LOOKAHEAD=25

[ITWhisperer]

I am not sure if this is your problem but, from the event, it looks like the second time format should be

TIME_FORMAT=%m/%d/%Y %I:%M:%S %p %s