topic Re: Disable source timestamp match in Getting Data In

Disable source timestamp match

craigmunro — Wed, 15 Jun 2011 08:20:58 GMT

I have a load of warnings in splunkd.log like:

06-15-2011 09:02:23.860 +0100 WARN  DateParserVerbose - A possible timestamp match (14.04.31) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.  Context="source::/opt/app/engine/work/hostname-4/log/engine-4.06.02.2011-14.04.31.log|host::hostname|staging|remoteport::16592"

Everything is getting indexed correctly and I understand from http://www.splunk.com/base/Documentation/4.2.1/Data/HowSplunkextractstimestamps that the timestamp in the log has higher precedence.

How can I stop Splunk from looking at the timestamp in the source name and issuing a warning?

I tried specifying the following in props.conf on the indexer but it hasn't helped.

TIME_FORMAT=%m/%d/%y %H:%M:%S.%3N

Thanks

Re: Disable source timestamp match

MarioM — Wed, 15 Jun 2011 10:02:33 GMT

did you try to force timestamp with TIME_PREFIX?

Re: Disable source timestamp match

craigmunro — Wed, 15 Jun 2011 10:17:53 GMT

No, I didn't. The default TIME_PREFIX is an empty string which is correct for this log and the timestamp is being extracted correctly from the source.

Re: Disable source timestamp match

MarioM — Wed, 15 Jun 2011 10:22:05 GMT

what i meant is by forcing the positionning of the timestamp ,it will stop splunk to look for timestamp elsewhere

Re: Disable source timestamp match

craigmunro — Thu, 16 Jun 2011 09:00:06 GMT

I tried adding TIME_PREFIX= (ie. timestamp is at start of line) and it didn't have any effect.

My understanding is that that would only affect timestamp extraction from the actual event. Timestamp extraction from the event is working correctly, the warning is being issued as Splunk tries to extract the timestamp from the filename of the log.

Re: Disable source timestamp match

craigmunro — Thu, 16 Jun 2011 09:01:04 GMT

This is a workaround to prevent the messages from appearing in the logs:

splunk _internal call /server/logger/DateParserVerbose -post:level ERROR

Re: Disable source timestamp match

marcoscala — Mon, 31 Mar 2014 15:24:40 GMT

You should have been added
TIME_PREFIX=^

^ meas "start of line".