Getting Data In

Time/Date Stamp errors

edwardrose
Contributor

Hello

I have empty log files that get monitored and I keep getting the following warnings:

Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event

So some systems the log files aren't empty and on others the files are empty. I am only getting the warning on systems with empty log files which to makes no sense. Are there any ideas?

thanks

0 Karma

woodcock
Esteemed Legend

Your log files are not truly empty; they must be receiving some whitespace or unprintable control characters. Let's assume the former and do something like this:

In props.conf:

[source::/your/source/here]
TRANSFORMS-drop_empty_lines = drop_empty_lines

In transforms.conf:

[drop_empty_lines]
REGEX = ^\s+$
DEST_KEY=queue
FORMAT=nullQueue

So instead of parsing these lines and not finding a timestamp, these are thrown away.

0 Karma

snigdhasaxena
Communicator

Hi @edwardrose ,

I think you should use a TA for the type of log you're ingesting in order to get the timestamp and log content in right format.

Are you using a TA already ?

Regards,
Snigdha

0 Karma

edwardrose
Contributor

Hello Snigdha,

I am using a TA to collect the data and again like I explained to Giuseppe, a log file is created but the file is empty. So I am just wondering why and how Splunk is reading a log file that has zero data in it and generating a warning about timestamps.

thanks
ed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi edwardrose,
at first, what do you mean with "empty log files", it's correct that there isn't any log (and you want to alert when there isn't any log) or logs are present and you don't see them?

Then, could you share any sample of your logs?

Anyway, this message means that Splunk cannot find or recognize a timestamp, so probably you have to define a correct timeformat and time prefix.

Bye.
Giuseppe

0 Karma

edwardrose
Contributor

Hello Giuseppe,

When I say empty, I mean that the file is created but there is no data in the log file. So there is nothing for the props.conf to compare a timestamp with, which is why I am wondering why I am getting the error.

Thanks
ed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi edwardrose,
I don't understand if "no data in the log file" means that something should be in the log file but there isn't or that there isn't nothing to log so it's correct to have an empty file.
In the first case, you should understand why your application doesn't log in the file; in the second case it's correct not indexing.
The most important thing is why you have an error when logs are present.
Could you share some sample of your logs?
Having a sample it's possible to set a correct props.conf to index your logs.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...