Getting Data In

Creating a sourcetype keeps failing

NanSplk01
Communicator

I have a sourcetype that I have been trying to break my logs apart, but I keep getting:  Failed to parse timestamp:  Here is an example:

[ logs ]
CHARSET=UTF-8
EVENT_BREAKER_ENABLE=true
LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\,\d{3}
MAX_EVENTS=135000
MAX_TIMESTAMP_LOOKAHEAD=23
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N
TRUNCATE=50000
TZ=America/New_York
disabled=false
pulldown_type=true

 

The logs look like they are broken correctly, but I still keep getting the error about the timestamp.

Here is an example of the logs:

2022-04-25 11:28:17,743 ERROR [148] Method:C1222.MessageProcessor.ProcessResponseMessage -- String[] {Unexpected Exception:
Internal Error - Unable to find Endpoint by ApTitle. - ApTitle: 2.16.124.113620.1.22.0.1.1.64.5541482OldDeviceAddress: x.xx.xxx.xxxxxx.x.xx.x.x.x.xx.xxxxxxx, Internal Error - Unable to find Endpoint by ApTitle.}
Itron.Ami.Common.Logging.AmiException: Internal Error - Unable to find Endpoint by ApTitle.
2022-04-25 11:28:17,759 ERROR [148] Method:C1222.MessageProcessor.ProcessResponseMessage -- Unexpected System Exception: AmiException - Internal Error - Unable to find Endpoint by ApTitle. received - contact Application manager.

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

That seems correct definition except that I propose you to add 

TIME_PREFIX = ^

to splunk start to look timestamp from beginning of event.

Actually length of your timestamp is 24 not 23. So you must increase that

MAX_TIMESTAMP_LOOKAHEAD at least 24, but better add it e.g. 30

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

That seems correct definition except that I propose you to add 

TIME_PREFIX = ^

to splunk start to look timestamp from beginning of event.

Actually length of your timestamp is 24 not 23. So you must increase that

MAX_TIMESTAMP_LOOKAHEAD at least 24, but better add it e.g. 30

r. Ismo

0 Karma

NanSplk01
Communicator

The solution worked.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...