Getting Data In

Creating a sourcetype keeps failing

NanSplk01
Engager

I have a sourcetype that I have been trying to break my logs apart, but I keep getting:  Failed to parse timestamp:  Here is an example:

[ logs ]
CHARSET=UTF-8
EVENT_BREAKER_ENABLE=true
LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\,\d{3}
MAX_EVENTS=135000
MAX_TIMESTAMP_LOOKAHEAD=23
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=true
TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N
TRUNCATE=50000
TZ=America/New_York
disabled=false
pulldown_type=true

 

The logs look like they are broken correctly, but I still keep getting the error about the timestamp.

Here is an example of the logs:

2022-04-25 11:28:17,743 ERROR [148] Method:C1222.MessageProcessor.ProcessResponseMessage -- String[] {Unexpected Exception:
Internal Error - Unable to find Endpoint by ApTitle. - ApTitle: 2.16.124.113620.1.22.0.1.1.64.5541482OldDeviceAddress: x.xx.xxx.xxxxxx.x.xx.x.x.x.xx.xxxxxxx, Internal Error - Unable to find Endpoint by ApTitle.}
Itron.Ami.Common.Logging.AmiException: Internal Error - Unable to find Endpoint by ApTitle.
2022-04-25 11:28:17,759 ERROR [148] Method:C1222.MessageProcessor.ProcessResponseMessage -- Unexpected System Exception: AmiException - Internal Error - Unable to find Endpoint by ApTitle. received - contact Application manager.

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

That seems correct definition except that I propose you to add 

TIME_PREFIX = ^

to splunk start to look timestamp from beginning of event.

Actually length of your timestamp is 24 not 23. So you must increase that

MAX_TIMESTAMP_LOOKAHEAD at least 24, but better add it e.g. 30

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

That seems correct definition except that I propose you to add 

TIME_PREFIX = ^

to splunk start to look timestamp from beginning of event.

Actually length of your timestamp is 24 not 23. So you must increase that

MAX_TIMESTAMP_LOOKAHEAD at least 24, but better add it e.g. 30

r. Ismo

0 Karma

NanSplk01
Engager

The solution worked.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...