Splunk Cloud Platform

Is there any other checks we need to perform to solve data quality issues?

sharada
Loves-to-Learn Everything

Hi All,

 

We are receiving below timestamp  issues,

0000 WARN DateParserVerbose [104706 merging_0] - Accepted time format has changed ((?i)(?<![\d\.])(20\d\d)([-/])([01]?\d)\2([012]?\d|3[01])\s+([012]?\d):([0-6]?\d):([0-6]?\d)\s*(?i)((?:(?:UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?), possibly indicating a problem in extracting timestamp

12-27-2021 14:33:04.972 +0000 WARN DateParserVerbose [104095 merging_0] - Accepted time format has changed ((?i)(?<![\w\.])(?i)(?i)(0?[1-9]|[12]\d|3[01])(?:st|nd|rd|th|[,\.;])?([\- /]) {0,2}(?i)(?:(?i)(?<![\d\w])(jan|\x{3127}\x{6708}|feb|\x{4E8C}\x{6708}|mar|\x{4E09}\x{6708}|apr|\x{56DB}\x{6708}|may|\x{4E94}\x{6708}|jun|\x{516D}\x{6708}|jul|\x{4E03}\x{6708}|aug|\x{516B}\x{6708}|sep|\x{4E5D}\x{6708}|oct|\x{5341}\x{6708}|nov|\x{5341}\x{3127}\x{6708}|dec|\x{5341}\x{4E8C}\x{6708})[a-z,\.;]*|(?i)(0?[1-9]|1[012])(?!:))\2 {0,2}(?i)(20\d\d|19\d\d|[9012]\d(?!\d))(?![\w\.])), possibly indicating a problem in extracting timestamps

All the Linux servers that are sending logs to Splunk are in EST timezone and we are expecting the same timezone to be indexed at. But we are still seeing issues not able to identify which of the servers are causing timezone issues. Is there any other checks we need to perform to solve the above errors.

Thanks,

Sharada

Labels (3)
0 Karma

vigneshnarendra
Explorer

What values have you set at props.conf for this source? Do you have a regex based extraction?
If you haven't configured any props, I suggest you to write one.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...