Splunk Search
Highlighted

timestamp parsing issue for a specific time

Path Finder

my log is:

2016-12-22 00:01:11,076 [myid:123] - INFO [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] - Accepted data from

in the props:

TIMEPREFIX = ^
MAX
TIMESTAMPLOOKAHEAD = 30
TIME
FORMAT = %Y-%m-%d %H:%M:%S,%3N

but i am still getting this error " failed to parse the timestamp" . after increasing the lookahead value , this error was disappeared for some time and it started to come back again. can anyone please help me to figure out what might be the issue .

0 Karma
Highlighted

Re: timestamp parsing issue for a specific time

SplunkTrust
SplunkTrust

MAXTIMESTAMPLOOKAHEAD value should be 23, length of timestamp.

0 Karma
Highlighted

Re: timestamp parsing issue for a specific time

Esteemed Legend

The length of the timestamp is 23 characters, not 30, so you need:

MAX_TIMESTAMP_LOOKAHEAD = 23
0 Karma
Highlighted

Re: timestamp parsing issue for a specific time

Path Finder

i added the buffer of 7 .

0 Karma
Highlighted

Re: timestamp parsing issue for a specific time

Esteemed Legend

Don't do that.

0 Karma
Highlighted

Re: timestamp parsing issue for a specific time

Esteemed Legend

You are going to have to find the events that are different that what you are expecting. Start by searching broadly and using the Patterns tab and the punct field to discern differences in log structure.

0 Karma