Getting Data In
Highlighted

received event and Failed to parse timestamp

New Member

Hi,

I didn't found the answer. I got splunk 5.0.1 and it worked good!
Since I've installed four apps :
-TA-ciscoasa
-Splunk
forCiscoASA
-maps
-sideview
utils

I restart splunk , I added data syslog with UDP port 514 and I see a yellow bar with :
"received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:514' host='host::192.X.X.X' sourcetype='sourcetype::cisco:asa' (1 missing total)"

And in my splunkd.log we can see :
"DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Wed Jan 23 11:29:58 2013). Context: source::514|host::192.X.X.X|syslog|"

Would I have missed a conf ?

Thanks to help me !

Tags (1)
0 Karma
Highlighted

Re: received event and Failed to parse timestamp

SplunkTrust
SplunkTrust

The bar suggests you're trying to write events into an index 'firewall' that doesn't exist.

Compare your inputs on all forwarders with the indexes on your indexers, they likely don't fit together.

0 Karma
Highlighted

Re: received event and Failed to parse timestamp

New Member

yeah , that's why i don't understand in /usr/local/splunk/etc/system/local/ I can see : inputs.conf README server.conf tenants.conf that's all ...

0 Karma
Highlighted

Re: received event and Failed to parse timestamp

Legend

system/local is one of many many places configuration files can reside in. It's not enough to check just that one.

0 Karma
Highlighted

Re: received event and Failed to parse timestamp

New Member

I have to search indexes.conf ?

0 Karma
Highlighted

Re: received event and Failed to parse timestamp

SplunkTrust
SplunkTrust

As Ayn said, there potentially are a million places that may contain configuration. To make sure you need to check each and every one.

0 Karma
Highlighted

Re: received event and Failed to parse timestamp

New Member

I proceeded otherwise, I used splunkforward and there is no message now

0 Karma
Highlighted

Re: received event and Failed to parse timestamp

New Member

Nobody know ?

0 Karma