Splunk Cloud Platform

How to parse timestamp & other fields in logs with no timestamp?

Sid
Explorer

log sample
[6724268.575s][debug][gc,age] GC(10561) Desired survivor size 33554432 bytes, new threshold 1 (max threshold 15)

I am getting timestamp parsing errors for the above source logs

using below props

DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
TRUNCATE = 999999
TZ = America/New_York
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk should not be trying to find a timestamp when DATETIME_CONFIG=CURRENT is used.  Perhaps, however, the TZ setting is overriding that.  Try removing the TZ setting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Sid
Explorer

previously i had only DATETIME_CONFIG=CURRENT but i was still getting timestamp parsing error in data quality dashboard , so i added TZ later.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...