"Failed to parse Timestamp. Defaulting to file modtime"- Error message

[nandhini_amir]

Hi,

It will be so helpful for me, if anybody could give a solution to the following question

When i am trying to parse the data into splunk before indexing, the timestamp of the events were not identified properly and it is showing "Failed to parse timestamp. Defaulting to file modtime" what should i do now to resolve this.

The timestamp in the log events are in the format of 201908162035357024.00 that is 2019-08-16 20:35:35

[harsmarvania57]

Hi,

You can use below configuration on Indexer to parse timestamp correctly. Below configuration will parse 20190816203535702 . Can you please confirm whether timestamp in raw event is at starting point ? If yes then you can add TIME_PREFIX = ^ in below configuration.

props.conf

[yourSourcetype]
TIME_FORMAT = %Y%m%d%H%M%S%3N
MAX_TIMESTAMP_LOOKAHEAD = 17

[nandhini_amir]

yes, the timestamp is in starting point. Thanks i will check this and will find how it works