Splunk Cloud Platform

How can we resolve this Data Quality_Issue?

jackin
Path Finder

We are facing data quality issue 
Sample internal log:
WARN messages in splunkd logs as follows DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event (Thu May 4 13:02:33 2023). 

I saw some different kind of logs are reporting to production splunk
Sample log of production:
++++++++++++++++++++++++++++++++++++++++++++++++
+ New app   'esign-ec-api'                                                    +
++++++++++++++++++++++++++++++++++++++++++++++
+ Initializing app  'esign-ec-api'                                                    +
++++++++++++++++++++++++++++++++++++++++++++++
Pinging the JVM took 7 seconds to respond.
++++++++++++++++++++++++++++++++++++++++++++++
+ starting app  'esign-ec-api'                                                    +
++++++++++++++++++++++++++++++++++++++++++++++

[props]

Charset=UTF-8

TIME_PREFIX=^\w{4,7}\s+

TIME_FORMAT=%Y-%m-%d %H.%M.%S,%3N

MAX_TIMESTAMP_LOOKAHEAD=40

SHOULD_LINEMERGE=false

NO_BINARY_CHECK=true

TRUNCATE=50000

Pulldown_Type=True

LINE_BREAKER=([\r\n])\w+\s+\d+\-\d+\-\d+\s\d+\:\d+\:\d+

EXTRACT-field1=regex

EXTRACT-field2=regex

Thank You

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if that first part is your event,  then it haven’t any timestamp. For that reason your props.conf cannot match it.

r. Ismo

0 Karma

jackin
Path Finder

How to avoid this kind of log from ingestion ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...