Problem:
I am running this query and I am trying to parse timestamps like "2019-01-21T21:49:48Z"
_sourceCategory=abcd/prod/*
| json auto
| parseDate(%"my.date_time", "yyyy-MM-dd'T'HH:mm:ss'Z'") as start_time
I get the following error :
The following errors were reported when executing your search: Oops! Looks like we encountered a problem. Try running your query again. If the problem persists, please contact Support. [Error Code: T5JAS-Y1NWS-1DKGV] (500)
Cause:
Presently the Sumo Logic UI reports the "Oops!Looks like we encountered a problem...." that the query failed because it processed a null or empty value in the time field in above example "my.date_time"
Answer:
Please add a line to the query that filters out empty values of the field that parseDate is processing. Refer to the isNull, isEmpty, isBlank operators that can take care of this. Following is a couple of examples
_sourceCategory=abc/prod/*
| json auto
| where !isEmpty(%"my.date_time")
| parseDate(%"my.date_time", "yyyy-MM-dd'T'HH:mm:ss") as start_time
_sourceCategory=abc/prod/*
| json auto
| where !isBlank(%"my.date_time")
| parseDate(%"grpc.start_time", "yyyy-MM-dd'T'HH:mm:ss") as start_time
Comments
0 comments
Please sign in to leave a comment.