Error message in sourcetype

[lefelle]

i have a file with filed date like 03/08/2016 09:25 GMT+02:00

My sourcetype doesn't work with
%d/%m/%Y %H:%M %Z%z
\d{2}/\d{2}/\d{4} \d{2}:\d{2} \d{2}:\d{2}

I have Failed to parse timestamp. defaulting to file modtime

Thanks

[lefelle]

Hi,

It doens't work. I try to declare my sourcetype and before to accept and validate my sourcetype, i have an error. I have create a sourcetype test to have the specification in props.conf

[test_snmp]
DATETIME_CONFIG =
MAX_TIMESTAMP_LOOKAHEAD = 255
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %d/%m/%Y %H:%M GMT%z
category = Custom
pulldown_type = true

[lguinn2]

I don't know exactly what you mean by "Error message in sourcetype", but in props.conf, you should have something like this:

[yoursourcetype]
TIME_FORMAT=%d/%m/%Y %H:%M GMT%z

The regular expression is not wanted or needed to describe the time in props.conf
You really don't want to use both %Z and %z in the timestamp. I would just go with the UTC offset, as clearly "GMT" is not the actual timezone, but the base for the offset.

You may have other settings in the stanza within props.conf that affect timestamp parsing as well. If this doesn't solve your problem, can you show us the entire stanza in props.conf?