Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

timeparsing issue for sourcetype

$
0
0
I have data like below:- Log file created at: **2019/03/24 17:56:14** Running on machine: F8976GMac Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg **I0324 17:56:14.700251** 16884 server.cpp:116] - 144.77.88.67 **I0324 17:56:14.747052** 16884 server.cpp:118] - Listening at : 28888, 28889, 28890 and i am getting following Warnings in _internal logs:- WARN DateParserVerbose - Accepted time (Wed Jul 6 07:27:19 2016) is suspiciously far away from the previous event's time (Fri Apr 5 07:27:19 2019), but still accepted because it was extracted by the same pattern. Please let know what timeparsing config fix can be made here since i see the same log file prints the complete timestamp at the start only and then only time is getting printed.

Viewing all articles
Browse latest Browse all 1485

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>