Hi Splunkers,
I am having the below issue could you please help me to solve the issue.
Here is my event
08-02-2021 20:46:39.852 +0000 WARN DateParserVerbose - Accepted time (Mon Aug 2 20:10:36 2021) is suspiciously far away from the previous event's time (Tue Aug 3 00:18:26 2021), but still accepted because it was extracted by the same pattern.
TIME 8/2/21
10:35:55.489 AM | EVENT 08-02-2021 10:35:55.489 -0400 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Mon Aug 2 10:35:53 2021). |
Here is my props.conf
[azure:prod]
DATETIME_CONFIG = CURRENT
TRUNCATE = 10000
MAX_TIMESTAMP_LOOKAHEAD = 128
