I want to monitor WindowsUpdate.log on windows PC, after selecting the data source, I got a flagged message saying “Failed to parse timestamp. Defaulting to file modtime. How can I resolve this error? Thank you.
Either your data does not contain timestamps or the timestamps are in an unexpected location/format. If the former, you'll have to live with the message; if the latter, correct the TIME_PREFIX
, TIME_FORMAT
, and MAX_TIMESTAMP_LOOKAHEAD
settings in your props.conf file.
@richgalloway, thanks for your response. I see about 6 props.conf... which one am I supposed to modify and what exactly am I supposed to correct the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD settings to?
I'm a newbie learning splunk. Thank you.
Thank you.
None of those. Choose Splunk\etc\system\local. Even better is Splunk\etc\apps\<myapp>\local
(create it if it doesn't exist). Create a stanza that matches the sourcetype of your data. The exact value of the settings depends on your data. Please share a sample.