Timestamp error: “Failed to parse timestamp. Defaulting to file modtime.

[s1j1yem1x]

I want to monitor WindowsUpdate.log on windows PC, after selecting the data source, I got a flagged message saying “Failed to parse timestamp. Defaulting to file modtime. How can I resolve this error? Thank you.

[richgalloway]

Either your data does not contain timestamps or the timestamps are in an unexpected location/format. If the former, you'll have to live with the message; if the latter, correct the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD settings in your props.conf file.

[s1j1yem1x]

@richgalloway, thanks for your response. I see about 6 props.conf... which one am I supposed to modify and what exactly am I supposed to correct the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD settings to?

I'm a newbie learning splunk. Thank you.

Thank you.

[richgalloway]

None of those. Choose Splunk\etc\system\local. Even better is Splunk\etc\apps\<myapp>\local (create it if it doesn't exist). Create a stanza that matches the sourcetype of your data. The exact value of the settings depends on your data. Please share a sample.