All Apps and Add-ons

Anyone getting this error? DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128)

np_hwp
Engager

Have anyone gotten this error message after installation, and can point me to a direction to resolve it?

WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Tue Dec 17 14:01:08 2019). Context: source=/opt/Firepower/splunk/etc/apps/TA-eStreamer|host=splumkhf.domain.com|cisco:estreamer:data|83258

0 Karma

jmantor
Path Finder

IS there a fix for this? I'm running 3.5.8 and seeing a lot of these warnings

0 Karma

jsfennell
Engager

Just tracked down this same issue, the "cisco:estreamer:data" sourcetype is expecting the event_sec field for timestamp. There are a number of events that do not contain that field.

sourcetype="cisco:estreamer:data" NOT event_sec="*"

Also, this addon needs reworking to handle the FIELDALIAS behavior changes after 7.2.4
https://docs.splunk.com/Documentation/Splunk/8.0.1/ReleaseNotes/Fieldaliasbehaviorchange

woodcock
Esteemed Legend
0 Karma

codebuilder
SplunkTrust
SplunkTrust

This means that Splunk is not finding the timestamp in your event where it is expecting to find it.
Or, it is not in the format expected and is being 'overlooked'.

All settings related to this can be found within props.conf, and could be one of several...
DATETIME_CONFIG
TIME_PREFIX
TIME_FORMAT

I would suggest you manually upload some sample events via the web UI, apply the sourcetype and preview the results. This should show you what is going wrong the the date/time extraction.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...