Getting Data In
Highlighted

How to resolve a "DateParserVerbose - Failed to parse timestamp" error with Ironport logs?

Path Finder

I have an Ironport log file that looks like the following:

Thu Nov 17 16:11:20 2016 Info: MID 123456789 ICID 123456789 To:  Rejected by Receiving Control
Thu Nov 17 16:11:20 2016 Info: MID 123456789 queued for delivery
Thu Nov 17 16:11:20 2016 Info: MID 123456789 Outbreak Filters: verdict negative
Thu Nov 17 16:11:20 2016 Info: Message finished MID 123456789 aborted
Thu Nov 17 16:11:20 2016 Info: Message aborted MID 123456789 Receiving aborted by sender

I have configured the props.conf on the indexer under the /opt/splunk/etc/system/local as the following but I am still getting the "Failed to parse timestamp" errors.

[source::/var/log/proxy/ironport/*/mail.*@*.s]
SHOULD_LINEMERGE = false
TIME_FORMAT = %a %b %_d %H:%M:%S %Y
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 25

The full error message is

11-17-2016 17:09:58.593 +0000 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Thu Nov 17 16:22:07 2016). Context: source::/var/log/proxy/ironport/mail.text.mariner.yyy.corp.com.@20161117T162003.s|host::xxxxxslg01.xxxx.company.com|cisco_esa|376273
0 Karma
Highlighted

Re: How to resolve a "DateParserVerbose - Failed to parse timestamp" error with Ironport logs?

Communicator

Remove the timeformat and timeprefix settings. Splunk will read that timestamp correctly. I copied/pasted your log data into a file, uploaded it, and timestamps were extracted auto-magically.

0 Karma
Highlighted

Re: How to resolve a "DateParserVerbose - Failed to parse timestamp" error with Ironport logs?

Path Finder

Thank you!

0 Karma
Highlighted

Re: How to resolve a "DateParserVerbose - Failed to parse timestamp" error with Ironport logs?

Path Finder

It seemed to be working for awhile but I am seeing the same message again

0 Karma
Highlighted

Re: How to resolve a "DateParserVerbose - Failed to parse timestamp" error with Ironport logs?

Communicator

I just realized this is still out there. Sorry I missed that.
Have you seen:
http://wiki.splunk.com/Set_up_Splunk_for_Cisco_IronPort_Web_Security_Appliance
This might be the easiest thing to do, as CiscoWSAsquid is a known sourcetype, and should make you life alot easier.

0 Karma
Highlighted

Re: How to resolve a "DateParserVerbose - Failed to parse timestamp" error with Ironport logs?

Path Finder

We have already configured the Ironport feeds with a rename of the sourcetype to cisco:esa:legacy and linked it to the CIM model so any change is not possible. I have approached Splunk Support and they have referred me back to Splunk Answers since this is not a break fix. However, this is not working as prescribed so we are looking for some help to resolve this issue

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.