I'm seeing the below error in splunkd.log of an indexer
WARN DateParserVerbose - Failed to parse timestamp.
The error does give me source file, host sourcetype. But it didnt give me the event for which the timestamp fails.
Only a fraction of the logs are having issues so im not able to find them.
Is there any way to better solve this?
If you're on 4.3, by far the easiest way to accomplish this is to use the data preview wizard using a sample log file from the host and sourcetype indicated in the log file.
It will assist you in generating the proper props.conf for that input.
If you're on 4.3, by far the easiest way to accomplish this is to use the data preview wizard using a sample log file from the host and sourcetype indicated in the log file.
It will assist you in generating the proper props.conf for that input.