Splunk Search

Receiving timestamp parsing error

vjsplunk
Loves-to-Learn Lots

I am trying to set timestamp for the event :

========

Sat Mar 19 16:33:08 2022 -05:00

LENGTH : '228'

ACTION :[7] 'CONNECT'

DATABASE USER:[1] '/'

=========

The rules I used are:

TIME_FORMAT = %a %b %d %H:%M:%S %Y %:z

TIME_PREFIX = ^

MAX_TIMESTAMP_LOOKAHEAD = 32

It is catching the timestamp correctly. However showing the error "could not use strptime to parse timestamp from LENGTH : '228' "

I am not sure how to resolve the error.

Labels (2)
0 Karma

vjsplunk
Loves-to-Learn Lots

Thank you. These are the sample lines:

========

Sat Mar 19 16:33:08 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_44388_20220319163308485740872483.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.14.0.0.0

 

Sat Mar 19 15:25:42 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_4908_20220319152542116439456508.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production

==============

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Have you set the following attributes properly? It seems an issue with the line-breaking or line-merging because Splunk is also trying to parse the timestamp on the second line as well.

  • SHOULD_LINEMERGE
  • LINE_BREAKER
0 Karma

vjsplunk
Loves-to-Learn Lots

Yes. I have applied the below 2 rules:

LINE_BREAKER = ([\r\n]+)

SHOULD_LINEMERGE = true

 

Line breaking is proper. Not sure it is showing the error

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

If SHOULD_LINEMERGE=true then you have specified when to break the event.

I would suggest using SHOULD_LINEMERGE=false and updating the LINE_BREAKER accordingly. (Gives better performance and hopefully resolves your error too.)

Please provide two-three sample events as they are in the file and I can help you write the LINE_BREAKER.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

It seems you have a single line event, use SHOULD_LINEMERGE=false then along with your current configuration.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...