Splunk Cloud Platform

How to parse timestamp & other fields in logs with no timestamp?

Sid
Explorer

log sample
[6724268.575s][debug][gc,age] GC(10561) Desired survivor size 33554432 bytes, new threshold 1 (max threshold 15)

I am getting timestamp parsing errors for the above source logs

using below props

DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
TRUNCATE = 999999
TZ = America/New_York
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk should not be trying to find a timestamp when DATETIME_CONFIG=CURRENT is used.  Perhaps, however, the TZ setting is overriding that.  Try removing the TZ setting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Sid
Explorer

previously i had only DATETIME_CONFIG=CURRENT but i was still getting timestamp parsing error in data quality dashboard , so i added TZ later.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...