https://community.splunk.com/t5/Getting-Data-In/WARN-DateParserVerbose-in-splunkd-log-How-do-i-find-out-which/m-p/35662#M6504 <P>I am seeing DateParserVerbose messages that say the matched timestamp is not cool, but the matched timestamp appears to be that moment.</P> <P>For example, notice the time of the log message and timestamp mentioned.</P> <PRE><CODE>01-29-2011 00:10:54.403 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:10:53 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 01-29-2011 00:10:59.402 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:10:58 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 01-29-2011 00:11:01.463 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:11:01 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 01-29-2011 00:11:07.586 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:11:06 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. </CODE></PRE> <P>Can anyone offer advice for tracking down the problem source? I have too many events to go looking for that exact timestamp. Maybe there is some debugging i can put to DateParserVerbose?</P> Sat, 29 Jan 2011 08:33:47 GMT gfriedmann 2011-01-29T08:33:47Z https://community.splunk.com/t5/Getting-Data-In/WARN-DateParserVerbose-in-splunkd-log-How-do-i-find-out-which/m-p/35662#M6504 <P>I am seeing DateParserVerbose messages that say the matched timestamp is not cool, but the matched timestamp appears to be that moment.</P> <P>For example, notice the time of the log message and timestamp mentioned.</P> <PRE><CODE>01-29-2011 00:10:54.403 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:10:53 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 01-29-2011 00:10:59.402 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:10:58 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 01-29-2011 00:11:01.463 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:11:01 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 01-29-2011 00:11:07.586 WARN DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:11:06 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. </CODE></PRE> <P>Can anyone offer advice for tracking down the problem source? I have too many events to go looking for that exact timestamp. Maybe there is some debugging i can put to DateParserVerbose?</P> Sat, 29 Jan 2011 08:33:47 GMT https://community.splunk.com/t5/Getting-Data-In/WARN-DateParserVerbose-in-splunkd-log-How-do-i-find-out-which/m-p/35662#M6504 gfriedmann 2011-01-29T08:33:47Z https://community.splunk.com/t5/Getting-Data-In/WARN-DateParserVerbose-in-splunkd-log-How-do-i-find-out-which/m-p/35663#M6505 <P>On the version we're running, 4.2.3, those events have a field at the end that looks like:</P> <PRE><CODE>Context="source::SOURCE|host::HOST|SOURCETYPE|remoteport::PORT" </CODE></PRE> <P>I didn't see what version of Splunk you're using, but perhaps this is something that was added to the latest versions of Splunk?</P> Thu, 27 Oct 2011 13:54:03 GMT https://community.splunk.com/t5/Getting-Data-In/WARN-DateParserVerbose-in-splunkd-log-How-do-i-find-out-which/m-p/35663#M6505 mfrost8 2011-10-27T13:54:03Z