If you can send that data to Splunk, it should be able to handle it. It will create appropriate buckets and index the data. You'll find error messages like the following in the splunkd.log, but you can ignore them.
A possible timestamp match (Tue May 23 08:01:43 2022) is outside of the acceptable time window.
• Accepted time (Tue May 23 00:33:16 2022) is suspiciously far away from the previous event's time (Thu May 25 14:10:32 2022), but still acceptable because it was extracted by the same pattern Splunk
• Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of the event. Splunk
You can also look into increasing the values for MAX_DIFF_SECS_AGO in props.conf for this sourcetype or just ignore the errors. Your call.
###If this helps, kindly consider accepting as an answer###
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
