Splunk Search

Error message in sourcetype

New Member

i have a file with filed date like 03/08/2016 09:25 GMT+02:00

My sourcetype doesn't work with
%d/%m/%Y %H:%M %Z%z
\d{2}/\d{2}/\d{4} \d{2}:\d{2} \d{2}:\d{2}

I have Failed to parse timestamp. defaulting to file modtime


Tags (1)
0 Karma

New Member


It doens't work. I try to declare my sourcetype and before to accept and validate my sourcetype, i have an error. I have create a sourcetype test to have the specification in props.conf

TIME_FORMAT = %d/%m/%Y %H:%M GMT%z
category = Custom
pulldown_type = true

0 Karma


I don't know exactly what you mean by "Error message in sourcetype", but in props.conf, you should have something like this:

TIME_FORMAT=%d/%m/%Y %H:%M GMT%z

The regular expression is not wanted or needed to describe the time in props.conf
You really don't want to use both %Z and %z in the timestamp. I would just go with the UTC offset, as clearly "GMT" is not the actual timezone, but the base for the offset.

You may have other settings in the stanza within props.conf that affect timestamp parsing as well. If this doesn't solve your problem, can you show us the entire stanza in props.conf?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...