Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Could not use strptime to parse timestamp
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could not use strptime to parse timestamp
Hi all,
I'm adding detail files from FreeRadius, which looks like following:
Wed May 2 10:28:04 2012
NAS-IP-Address = 192.168.193.67
User-Name = "a12345677"
NAS-Port = 0
NAS-Port-Type = Wireless-802.11
[snipped]
I specified following in props.conf:
TIME_FORMAT=%a %b %d %H:%M:%S %Y
TIME_PREFIX=^
The Data Preview panel complains about "Could not parse strptime to parse timestamp", although it is still okay to identify individual records. I wonder if I make any mistake in the format string . Would anyone please help?
Thanks a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any news on this topic?
I have the same problem...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I left this question unchecked for long tims, as the time can be parsed correctly...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same result after changing %d to %e.
Anyway, thanks for your help.
/ST
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
see update above. /k
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should change the %d (01-31) for a %e (1-31) in TIME_FORMAT.
UPDATE:
What are the values for timestartpos and timeendpos? Do they correspond to where your timestamp begins and ends? Those fields are automatically extracted, but to see them you may have to click the "View all XX fields" in the field picker on the left.
Perhaps you need to remove/change the TIME_PREFIX and specify a MAX_TIMESTAMP_LOOKAHEAD.
Please post a complete event, and what time splunk interprets, and the timestartpos and timeendpos.
Hope this helps,
Kristian
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I didnt see that option...good to know.
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
