Splunk Search

Could not use strptime to parse timestamp

stwong
Communicator

Hi all,

I'm adding detail files from FreeRadius, which looks like following:

Wed May 2 10:28:04 2012
NAS-IP-Address = 192.168.193.67
User-Name = "a12345677"
NAS-Port = 0
NAS-Port-Type = Wireless-802.11
[snipped]

I specified following in props.conf:

TIME_FORMAT=%a %b %d %H:%M:%S %Y
TIME_PREFIX=^

The Data Preview panel complains about "Could not parse strptime to parse timestamp", although it is still okay to identify individual records. I wonder if I make any mistake in the format string . Would anyone please help?

Thanks a lot.

Tags (1)

goelli
Communicator

Is there any news on this topic?
I have the same problem...

0 Karma

stwong
Communicator

I left this question unchecked for long tims, as the time can be parsed correctly...

0 Karma

stwong
Communicator

Same result after changing %d to %e.
Anyway, thanks for your help.

/ST

0 Karma

kristian_kolb
Ultra Champion

see update above. /k

0 Karma

kristian_kolb
Ultra Champion

You should change the %d (01-31) for a %e (1-31) in TIME_FORMAT.


UPDATE:
What are the values for timestartpos and timeendpos? Do they correspond to where your timestamp begins and ends? Those fields are automatically extracted, but to see them you may have to click the "View all XX fields" in the field picker on the left.

Perhaps you need to remove/change the TIME_PREFIX and specify a MAX_TIMESTAMP_LOOKAHEAD.

Please post a complete event, and what time splunk interprets, and the timestartpos and timeendpos.

Hope this helps,

Kristian

sdaniels
Splunk Employee
Splunk Employee

I didnt see that option...good to know.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...