Time/Date Stamp errors

[edwardrose]

Hello

I have empty log files that get monitored and I keep getting the following warnings:

Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event

So some systems the log files aren't empty and on others the files are empty. I am only getting the warning on systems with empty log files which to makes no sense. Are there any ideas?

thanks

[woodcock]

Your log files are not truly empty; they must be receiving some whitespace or unprintable control characters. Let's assume the former and do something like this:

In props.conf:

[source::/your/source/here]
TRANSFORMS-drop_empty_lines = drop_empty_lines

In transforms.conf:

[drop_empty_lines]
REGEX = ^\s+$
DEST_KEY=queue
FORMAT=nullQueue

So instead of parsing these lines and not finding a timestamp, these are thrown away.

[snigdhasaxena]

Hi @edwardrose ,

I think you should use a TA for the type of log you're ingesting in order to get the timestamp and log content in right format.

Are you using a TA already ?

Regards,
Snigdha

[edwardrose]

Hello Snigdha,

I am using a TA to collect the data and again like I explained to Giuseppe, a log file is created but the file is empty. So I am just wondering why and how Splunk is reading a log file that has zero data in it and generating a warning about timestamps.

thanks
ed

[gcusello]

Hi edwardrose,
at first, what do you mean with "empty log files", it's correct that there isn't any log (and you want to alert when there isn't any log) or logs are present and you don't see them?

Then, could you share any sample of your logs?

Anyway, this message means that Splunk cannot find or recognize a timestamp, so probably you have to define a correct timeformat and time prefix.

Bye.
Giuseppe

[edwardrose]

Hello Giuseppe,

When I say empty, I mean that the file is created but there is no data in the log file. So there is nothing for the props.conf to compare a timestamp with, which is why I am wondering why I am getting the error.

Thanks
ed

[gcusello]

Hi edwardrose,
I don't understand if "no data in the log file" means that something should be in the log file but there isn't or that there isn't nothing to log so it's correct to have an empty file.
In the first case, you should understand why your application doesn't log in the file; in the second case it's correct not indexing.
The most important thing is why you have an error when logs are present.
Could you share some sample of your logs?
Having a sample it's possible to set a correct props.conf to index your logs.
Bye.
Giuseppe