https://community.splunk.com/t5/Getting-Data-In/What-does-this-splunkd-log-DateParserVerbose-message-mean/m-p/75295#M15362 <P>Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp. </P> <P>If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - <CODE>MAX_DIFF_SECS_AGO</CODE> or <CODE>MAX_DIFF_SECS_HENCE</CODE>in <A href="http://www.splunk.com/base/Documentation/latest/Admin/Propsconf" rel="nofollow">props.conf</A></P> Fri, 22 Oct 2010 02:57:29 GMT Mick 2010-10-22T02:57:29Z https://community.splunk.com/t5/Getting-Data-In/What-does-this-splunkd-log-DateParserVerbose-message-mean/m-p/75294#M15361 <P><CODE>10-21-2010 09:19:40.631 WARN DateParserVerbose - Time parsed (Thu Oct 21 09:19:38 2010) is too far away from the previous event's time (Fri Oct 1 07:42:46 2010) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive.</CODE> </P> <P>Clearly, this is saying that there is an issue with splunk recognizing the timestamp or it believing that the event might have a wrong timestamp, however what really happens to this event?</P> <P>Does it not get indexed? (too far away to be accepted)<BR /> Does it get indexed with a different timestamp, or since this is just a warning it still gets indexed with this timestamp but splunk just wants to notify us?</P> Fri, 22 Oct 2010 02:42:04 GMT https://community.splunk.com/t5/Getting-Data-In/What-does-this-splunkd-log-DateParserVerbose-message-mean/m-p/75294#M15361 Genti 2010-10-22T02:42:04Z https://community.splunk.com/t5/Getting-Data-In/What-does-this-splunkd-log-DateParserVerbose-message-mean/m-p/75295#M15362 <P>Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp. </P> <P>If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - <CODE>MAX_DIFF_SECS_AGO</CODE> or <CODE>MAX_DIFF_SECS_HENCE</CODE>in <A href="http://www.splunk.com/base/Documentation/latest/Admin/Propsconf" rel="nofollow">props.conf</A></P> Fri, 22 Oct 2010 02:57:29 GMT https://community.splunk.com/t5/Getting-Data-In/What-does-this-splunkd-log-DateParserVerbose-message-mean/m-p/75295#M15362 Mick 2010-10-22T02:57:29Z