received event and Failed to parse timestamp

[yoann]

Hi,

I didn't found the answer. I got splunk 5.0.1 and it worked good!
Since I've installed four apps :
-TA-cisco_asa
-Splunk_for_CiscoASA
-maps
-sideview_utils

I restart splunk , I added data syslog with UDP port 514 and I see a yellow bar with :
"received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:514' host='host::192.X.X.X' sourcetype='sourcetype::cisco:asa' (1 missing total)"

And in my splunkd.log we can see :
"DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Wed Jan 23 11:29:58 2013). Context: source::514|host::192.X.X.X|syslog|"

Would I have missed a conf ?

Thanks to help me !

[yoann]

Nobody know ?

[yoann]

yeah , that's why i don't understand in /usr/local/splunk/etc/system/local/ I can see : inputs.conf README server.conf tenants.conf that's all ...

[yoann]

I proceeded otherwise, I used splunkforward and there is no message now

[martin_mueller]

As Ayn said, there potentially are a million places that may contain configuration. To make sure you need to check each and every one.

[yoann]

I have to search indexes.conf ?

[Ayn]

system/local is one of many many places configuration files can reside in. It's not enough to check just that one.

[martin_mueller]

The bar suggests you're trying to write events into an index 'firewall' that doesn't exist.

Compare your inputs on all forwarders with the indexes on your indexers, they likely don't fit together.