topic Re: DateParserVerbose Warnings in Getting Data In

DateParserVerbose Warnings

Anu — Tue, 01 Sep 2020 12:56:39 GMT

HI,

I see lot of DateParserverbose warnings in splunkd.log on my indexers.

The errors goes as follows:

WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive

DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.

@isoutamo

Re: DateParserVerbose Warnings

isoutamo — Tue, 01 Sep 2020 15:23:28 GMT

Can you share your props.conf and raw event samples before you are ingesting those?

r. Ismo

Re: DateParserVerbose Warnings

richgalloway — Tue, 01 Sep 2020 15:39:08 GMT

There are two common reasons for that warning.

1. The data has timestamps that vary widely. If this is expected then you either ignore the warning or change the MAX_DIFF_SECS_AGO and MAX_DIFF_SEC_HENCE settings.

2. Splunk is using the wrong part of the event as the timestamp. Double-check the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.