Splunk Search

Receiving timestamp parsing error

vjsplunk
Loves-to-Learn Lots

I am trying to set timestamp for the event :

========

Sat Mar 19 16:33:08 2022 -05:00

LENGTH : '228'

ACTION :[7] 'CONNECT'

DATABASE USER:[1] '/'

=========

The rules I used are:

TIME_FORMAT = %a %b %d %H:%M:%S %Y %:z

TIME_PREFIX = ^

MAX_TIMESTAMP_LOOKAHEAD = 32

It is catching the timestamp correctly. However showing the error "could not use strptime to parse timestamp from LENGTH : '228' "

I am not sure how to resolve the error.

Labels (2)
0 Karma

vjsplunk
Loves-to-Learn Lots

Thank you. These are the sample lines:

========

Sat Mar 19 16:33:08 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_44388_20220319163308485740872483.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.14.0.0.0

 

Sat Mar 19 15:25:42 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_4908_20220319152542116439456508.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production

==============

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Have you set the following attributes properly? It seems an issue with the line-breaking or line-merging because Splunk is also trying to parse the timestamp on the second line as well.

  • SHOULD_LINEMERGE
  • LINE_BREAKER
0 Karma

vjsplunk
Loves-to-Learn Lots

Yes. I have applied the below 2 rules:

LINE_BREAKER = ([\r\n]+)

SHOULD_LINEMERGE = true

 

Line breaking is proper. Not sure it is showing the error

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

If SHOULD_LINEMERGE=true then you have specified when to break the event.

I would suggest using SHOULD_LINEMERGE=false and updating the LINE_BREAKER accordingly. (Gives better performance and hopefully resolves your error too.)

Please provide two-three sample events as they are in the file and I can help you write the LINE_BREAKER.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

It seems you have a single line event, use SHOULD_LINEMERGE=false then along with your current configuration.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...