Getting Data In

Time/Date Stamp errors

edwardrose
Contributor

Hello

I have empty log files that get monitored and I keep getting the following warnings:

Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event

So some systems the log files aren't empty and on others the files are empty. I am only getting the warning on systems with empty log files which to makes no sense. Are there any ideas?

thanks

0 Karma

woodcock
Esteemed Legend

Your log files are not truly empty; they must be receiving some whitespace or unprintable control characters. Let's assume the former and do something like this:

In props.conf:

[source::/your/source/here]
TRANSFORMS-drop_empty_lines = drop_empty_lines

In transforms.conf:

[drop_empty_lines]
REGEX = ^\s+$
DEST_KEY=queue
FORMAT=nullQueue

So instead of parsing these lines and not finding a timestamp, these are thrown away.

0 Karma

snigdhasaxena
Communicator

Hi @edwardrose ,

I think you should use a TA for the type of log you're ingesting in order to get the timestamp and log content in right format.

Are you using a TA already ?

Regards,
Snigdha

0 Karma

edwardrose
Contributor

Hello Snigdha,

I am using a TA to collect the data and again like I explained to Giuseppe, a log file is created but the file is empty. So I am just wondering why and how Splunk is reading a log file that has zero data in it and generating a warning about timestamps.

thanks
ed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi edwardrose,
at first, what do you mean with "empty log files", it's correct that there isn't any log (and you want to alert when there isn't any log) or logs are present and you don't see them?

Then, could you share any sample of your logs?

Anyway, this message means that Splunk cannot find or recognize a timestamp, so probably you have to define a correct timeformat and time prefix.

Bye.
Giuseppe

0 Karma

edwardrose
Contributor

Hello Giuseppe,

When I say empty, I mean that the file is created but there is no data in the log file. So there is nothing for the props.conf to compare a timestamp with, which is why I am wondering why I am getting the error.

Thanks
ed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi edwardrose,
I don't understand if "no data in the log file" means that something should be in the log file but there isn't or that there isn't nothing to log so it's correct to have an empty file.
In the first case, you should understand why your application doesn't log in the file; in the second case it's correct not indexing.
The most important thing is why you have an error when logs are present.
Could you share some sample of your logs?
Having a sample it's possible to set a correct props.conf to index your logs.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...