topic troubleshooting. in Splunk Enterprise

troubleshooting.

whitecat001 — Thu, 29 Feb 2024 15:42:10 GMT

Am getting a warning of

  DateParserVerbose - Accepted time (Wed Feb 14 17:01:12 2024) is suspiciously far away from previous event  (Thu jan  18 17:01:12 2024) is still acceptable because it was extracted by the same pattern

Is there any configuration that can help take this error away in splunk

Re: troubleshooting.

richgalloway — Thu, 29 Feb 2024 16:59:18 GMT

Make sure the props.conf settings for that sourcetype have the correct time settings. Specifically, check the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD values.

Confirm the data source is sending the right events.

Re: troubleshooting.

isoutamo — Thu, 29 Feb 2024 17:28:47 GMT

Quite possibly there are missing time format on your props.conf. For that reason splunk guess between mm/dd/yyyy and dad/mm/yyyy formats.

Re: Troubleshooting.

whitecat001 — Thu, 29 Feb 2024 20:04:26 GMT

The first event that came in doesnt have a timestamp which is the reason for the error but the other events are extracted properly