Getting Data In

Time/Date Stamp errors

edwardrose
Contributor

Hello

I have empty log files that get monitored and I keep getting the following warnings:

Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event

So some systems the log files aren't empty and on others the files are empty. I am only getting the warning on systems with empty log files which to makes no sense. Are there any ideas?

thanks

0 Karma

woodcock
Esteemed Legend

Your log files are not truly empty; they must be receiving some whitespace or unprintable control characters. Let's assume the former and do something like this:

In props.conf:

[source::/your/source/here]
TRANSFORMS-drop_empty_lines = drop_empty_lines

In transforms.conf:

[drop_empty_lines]
REGEX = ^\s+$
DEST_KEY=queue
FORMAT=nullQueue

So instead of parsing these lines and not finding a timestamp, these are thrown away.

0 Karma

snigdhasaxena
Communicator

Hi @edwardrose ,

I think you should use a TA for the type of log you're ingesting in order to get the timestamp and log content in right format.

Are you using a TA already ?

Regards,
Snigdha

0 Karma

edwardrose
Contributor

Hello Snigdha,

I am using a TA to collect the data and again like I explained to Giuseppe, a log file is created but the file is empty. So I am just wondering why and how Splunk is reading a log file that has zero data in it and generating a warning about timestamps.

thanks
ed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi edwardrose,
at first, what do you mean with "empty log files", it's correct that there isn't any log (and you want to alert when there isn't any log) or logs are present and you don't see them?

Then, could you share any sample of your logs?

Anyway, this message means that Splunk cannot find or recognize a timestamp, so probably you have to define a correct timeformat and time prefix.

Bye.
Giuseppe

0 Karma

edwardrose
Contributor

Hello Giuseppe,

When I say empty, I mean that the file is created but there is no data in the log file. So there is nothing for the props.conf to compare a timestamp with, which is why I am wondering why I am getting the error.

Thanks
ed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi edwardrose,
I don't understand if "no data in the log file" means that something should be in the log file but there isn't or that there isn't nothing to log so it's correct to have an empty file.
In the first case, you should understand why your application doesn't log in the file; in the second case it's correct not indexing.
The most important thing is why you have an error when logs are present.
Could you share some sample of your logs?
Having a sample it's possible to set a correct props.conf to index your logs.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...