All Apps and Add-ons

Why am I receiving timestamp parsing errors in my BMC Remedy logs?

BradTaylor
Explorer

I'm getting these errors in my logs on indexer:

11-04-2016 02:44:58.058 -0400 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Fri Nov  4 04:44:49 2016). Context: source::/opt/bmc/ARSystem/db/aruser.log|host::ln98622|ARS log|253
11-04-2016 02:45:05.135 -0400 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Fri Nov  4 04:44:56 2016). Context: source::/opt/bmc/ARSystem/db/aruser.log|host::ln98621|ARS log|964
11-04-2016 02:45:11.390 -0400 WARN  DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Fri Nov  4 04:45:06 2016). Context: source::/opt/bmc/ARSystem/db/aruser.log|host::ln98622|ARS log|256

Timestamps in the log files are like this, starting at position 173 and running to position 206

/* Thu Nov 03 2016 22:52:17.2644 */ 

I've set the following in the props.conf:

TIME_PREFIX = \/\*.
TIME_FORMAT =  %a %b %d %Y %H:%M:%S.%4N

Lookahead = 35

Have I done something incorrectly?

The errors are not continuous, but fairly frequent.

thanks... Brad

0 Karma

mtranchita
Communicator

Perhaps reading too quickly but where you have "Lookahead" in your props did you mean MAX_TIMESTAMP_LOOKAHEAD?

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Brad,

Not sure if this is the info that can help you, but you can use Splunk Add-on for BMC Remedy to help you to create and update incidents in Remedy system from the Splunk platform:

https://splunkbase.splunk.com/app/3087

This add-on does not collect any data though. You can refer to the documentation here:

http://docs.splunk.com/Documentation/AddOns/released/Remedy/About

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...