Getting Data In

Possible bug in Monitoring Console (Indexing->Inputs-Data Quality->Timestamp Parsing issues)



I have a logfile that generates exceptions. When there is no exception it just generates event lines with a header and a footer.
These events without a timestamp generate timestamp parsing issues as expected.
This is shown in the MC-->ndexing->Inputs-Data Quality->Timestamp Parsing issues.

All correct so far....

So I have created a props and transforms to send these garbage header and footer events to the nullqueue. This works fine.
When I now search for this sourcetype the garbage events do no show up anymore. Exactly what I want....
But in the Monitoring Console this sourcetype / header footer garbage events still generate timestamp parsing issues.
I think this is a bug in Splunk?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!