Getting Data In

failed to parse timestamp at data preview

newbiesplunk
Path Finder

Hi,
When i do the data preview, it stated "Failed to parse timestamp, defaulting to file modetime". The correct timestamp for my event should be 2 Sep instead of 9 Feb. How to resolve it? If it due to the date configured at the server end or the setting at the splunk? thks

Tags (1)
0 Karma

newbiesplunk
Path Finder

Hi,
if i would like to extract the date (dd/mm/yyyy hh:mm:ss) in the content of the file as the timestamp as shown below, how to go abt doing it? thks

File content
Start;server;02/10/2014 16:13:13

tom_frotscher
Builder

Hi! Splunk can't automatically resolve your timestamp in this case. Therefore, it can fall back to use the time of the last modification of your logfile as a timestamp. If this is the case, you need to do some additional configuration. Is it possible that you post some example events of your logfile and show us the configuration you use for the corresponding sourcetype? Then we can help you to make splunk considering your timestamp correctly.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...