Splunk Cloud Platform

How to parse timestamp & other fields in logs with no timestamp?

Sid
Explorer

log sample
[6724268.575s][debug][gc,age] GC(10561) Desired survivor size 33554432 bytes, new threshold 1 (max threshold 15)

I am getting timestamp parsing errors for the above source logs

using below props

DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
TRUNCATE = 999999
TZ = America/New_York
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk should not be trying to find a timestamp when DATETIME_CONFIG=CURRENT is used.  Perhaps, however, the TZ setting is overriding that.  Try removing the TZ setting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Sid
Explorer

previously i had only DATETIME_CONFIG=CURRENT but i was still getting timestamp parsing error in data quality dashboard , so i added TZ later.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...