topic Re: DateParserVerbose warnings in Getting Data In

DateParserVerbose warnings

Anu — Tue, 01 Sep 2020 12:48:26 GMT

HI,

I see lot of DateParserverbose warnings in splunkd.log on my indexers.

The errors goes as follows:

WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive

DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.

Re: DateParserVerbose warnings

richgalloway — Tue, 01 Sep 2020 13:22:36 GMT

Splunk detected that the timestamps in that data source are further apart than expected. There are a couple possible explanations for that.

The data really does have timestamps that are far apart. If this is expected then you can ignore the warning or change the MAX_DIFF_SECS_AGO setting in props.conf.

Splunk could be parsing the wrong timestamp or interpreting another string as a timestamp. Review the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.

Re: DateParserVerbose warnings

Anu — Wed, 02 Sep 2020 07:34:58 GMT

But it was working well from long time.I see this errors from last 1 month.Is there any other reason why this can happen.

Re: DateParserVerbose warnings

thambisetty — Wed, 02 Sep 2020 07:37:23 GMT

take the event from the sourcetype for which you are seeing this error and try to upload using splunk web add data feature to understand if Splunk extracting time as expected. if not you need to define your right TIME_FORMAT in props.conf

Re: DateParserVerbose warnings

isoutamo — Wed, 02 Sep 2020 14:22:12 GMT

Have you checked that nobody have changed that log and/or those nodes’ time is still correct?

Re: DateParserVerbose warnings

Anu — Tue, 06 Oct 2020 11:49:58 GMT

yes. i'm sure that nobody changed it.@soutamo