Getting Data In

How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”?

Hemnaath
Motivator

Hi All,

I am trying to built the parsing stanza for one of the data, while testing I am getting an pop-up message stating that "could not use the strptime to parse timestamp from “2022-26-05T11:29:57”.

  As soon as I apply the Time_Format stanza the Splunk is throwing the message.  I am not sure what I am missing here.  so could you please help me resolving this issue.

 

Event details:

<Event CompactMode="1" sEventType="OpResult" dwBasicEventType="9" dwAppSpecificEventID="5000" sEventID="EVENT_ID_SCHEDULER_STARTED" sOriginatingApplicationName="RED Identity Management Console" sOriginatingApplicationComponent="Scheduler" sOriginatingApplicationVersion="5.5.3.0" sOriginatingSystem="XXXXXXXXXXXXX" sOriginatingAccount="XXXX\XXXXX" dtPostTime="2022-26-05T11:29:57" sMessage="RED Identity Management Console (running as user XXXX\XXXXX) on system XXXXXXXXXXXXX; - background processor started"/>

Props stanza

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\<Event
NO_BINARY_CHECK=true
TIME_PREFIX=dtPostTime\=\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD=20

Event Details:

[5/26/2022 4:09:55 PM UTC] Note: Unknown provider type; cannot verify object name 'tbl_BaseJobInfo' valid for data store.

Props.conf

SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\[\d+\/\d{2}\/\d{4}\s\d+\:\d{2}\:\d{2}\s[^\]]+\]
NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^\[
TIME_FORMAT=%m-%d-%Y %I:%M:%S %p %s
MAX_TIMESTAMP_LOOKAHEAD=25

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure if this is your problem but, from the event, it looks like the second time format should be

TIME_FORMAT=%m/%d/%Y %I:%M:%S %p %s
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...