topic Re: Troubleshooting in Splunk Enterprise

Troubleshooting

whitecat001 — Fri, 01 Mar 2024 21:56:56 GMT

Hello
I am getting this warning and the sample data looks like this


02-22-2012 17:01:12.280 +0000 WARN  DateParserVerbose - A possible timestamp match 
(Wed Feb 22 17:01:12 2012) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.  Context="source::/var/opt/jira/log/atlassian-jira-security.log|host::syn|atlassian_jira|remoteport::47375"

Re: Troubleshooting

PickleRick — Fri, 01 Mar 2024 21:58:36 GMT

Either you indeed have very strange data (from more than 10 years ago?) or you have badly onboarded sources and date is wrongly parsed.

Re: Troubleshooting

whitecat001 — Sat, 02 Mar 2024 22:39:55 GMT

Is there anything i can do to make the error go away?

Re: Troubleshooting

PickleRick — Sun, 03 Mar 2024 09:46:26 GMT

Yes. Verify your sources and their config in Splunk. Without more information we can't tell you anything more than that.