Splunk Cisco encore Events with no Timestamp

[b17gunnr]

Hello friends,

Splunk is cranky with errors stating: Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event. This is related to my Cisco estreamer ingest and there are no timestamps in any of the events.

Is there a way to tell the Indexer that there are no timestamps, that it should not use the lookahead, and configure the index time as the event time for the specific index and sourcetype?

Thank you.

[livehybrid · Accepted solution]

Hi @b17gunnr 

The Cisco Firepower app in Splunkbase doesnt have a props.conf to tell Splunk how to process timestamps so you will need to create a props.conf in the appropriate place and deploy out as per your other apps to the server that the data is parsed on (either Heavy Forwarder or Indexer(s)) - this will tell Splunk to use the receipt time:

Set DATETIME_CONFIG = NONE to prevent the timestamp processor from running. When timestamp processing is off, Splunk Enterprise does not look at the text of the event for the timestamp and instead uses the event time of receipt, the time the event arrives through its input. For file-based inputs, the event timestamp is taken from from the modification time of the input file.

Set DATETIME_CONFIG = CURRENT to assign the current system time to each event as Splunk Enterprise indexes it.

For more info check out https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-timestamps/config....

# props.conf - Update sourcetypes accordingly
[cisco:estreamer:log]
DATETIME_CONFIG = NONE

[cisco:estreamer:status]
DATETIME_CONFIG = NONE

[cisco:estreamer:data]
DATETIME_CONFIG = NONE

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PrewinThomas]

@b17gunnr 

If you want Splunk to stop searching for timestamps, just go to your Indexer or Heavy Forwarder (whichever is doing the parsing) and update the props.conf for the relevant sourcetype

Eg:

[your_sourcetype]
DATETIME_CONFIG = NONE
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true

Tells Splunk not to attempt timestamp extraction. It will use the index time as the event time

Note: Are you using any specific add-on for this?

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!