Getting Data In

Possible bug in Monitoring Console (Indexing->Inputs-Data Quality->Timestamp Parsing issues)

Azeemering
Builder

Hi,

I have a logfile that generates exceptions. When there is no exception it just generates event lines with a header and a footer.
These events without a timestamp generate timestamp parsing issues as expected.
This is shown in the MC-->ndexing->Inputs-Data Quality->Timestamp Parsing issues.

All correct so far....

So I have created a props and transforms to send these garbage header and footer events to the nullqueue. This works fine.
When I now search for this sourcetype the garbage events do no show up anymore. Exactly what I want....
But in the Monitoring Console this sourcetype / header footer garbage events still generate timestamp parsing issues.
I think this is a bug in Splunk?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.