Splunk Search

timestamp parsing issue for a specific time

kteng2024
Path Finder

my log is:

2016-12-22 00:01:11,076 [myid:123] - INFO [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] - Accepted data from

in the props:

TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N

but i am still getting this error " failed to parse the timestamp" . after increasing the lookahead value , this error was disappeared for some time and it started to come back again. can anyone please help me to figure out what might be the issue .

0 Karma

woodcock
Esteemed Legend

You are going to have to find the events that are different that what you are expecting. Start by searching broadly and using the Patterns tab and the punct field to discern differences in log structure.

0 Karma

woodcock
Esteemed Legend

The length of the timestamp is 23 characters, not 30, so you need:

MAX_TIMESTAMP_LOOKAHEAD = 23
0 Karma

kteng2024
Path Finder

i added the buffer of 7 .

0 Karma

woodcock
Esteemed Legend

Don't do that.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

MAX_TIMESTAMP_LOOKAHEAD value should be 23, length of timestamp.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...