I have below logs
Status: INFORMATION: Description: Beginning GDP Fransaction Script: 01-22-2023-01-13-04-PM
Status: INFORMATION: Description: txt file already exists
Status: INFORMATION: Description: csv file already exists
Status: OK: Description: C:\GDPFransactionScript\Inputs \GDPTestFile.csv copy to USB successful
Status: OK: Description: C:\GDPTransactionScript\Inputs \GDPTestFile.txt copy to USB successful
Status: ERROR: Description: http POST failed:
Status: ERROR: Description: https POST failed:
Status: INFORMATION: Description: End of GDP Transaction Script: 01-22-2023-01-13-04-PM
I have mentioned in my props
CHARSET=AUTO
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\Status
NO_BINARY_CHECK=true
disabled=false
TIME_PREFIX=^
But i am seeing error like failed to parse timestamp. Default to file modtime
How to resolve this issue
Most of the example events do not contain a timestamp so Splunk has to use the file mod-time or the current time. To use the current time, specify DATETIME_CONFIG = CURRENT.
Perhaps those lines are a single event. If so, then try these settings
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)Status INFORMATION: Description: Beginning
NO_BINARY_CHECK = true
disabled = false
TIME_PREFIX = Script:
TIME_FORMAT = %m-%d-%Y-%I:%M:%S-%p