failed to parse timestamp for event

[keiichilam]

HI

My splunk failed to parse timestamp of one of the inbound syslog.

10-03-2011 10:55:18.119 +0800 WARN DateParserVerbose - Failed to parse timestamp for event. Context="source::udp:514|host::TSSSYSLOG01|syslog|" Text="172.18.12.21, -, -, N, 2011-10-03, 11:02:45, 1, -, -, ProxyAV_Sec, 172.18.12.25, 1344, 906, 193, 0, ..."

I have renamed the sourcetype as proxyav in transforms.conf

in props.conf, I added follow
[proxyav]

SHOULD_LINEMERGE = false

# MAX_TIMESTAMP_LOOKAHEAD=60

# TIME_PREFIX = ^[^\,]+\,[^\,]+\,[^\,]+\,[^\,]+\,\s

# TIME_FORMAT = %Y-%m-%d, %T

# TIME_PREFIX = ^[^\,]+\,[^\,]+\,[^\,]+\,[^\,]+\,\s

TIME_FORMAT = %Y-%m-%d, %H:%M:%S,

KV_MODE = none

I did also tried various remarked setting, but no luck to remove the parse error. Could anyone give me a hand?

Best Regards

[mzorzi]

You should use the TIME_PREFIX, instead of ^[^,], I would use a regex for the ip, then a non space, like \S