Getting Data In

A possible timestamp match is outside of the acceptable time window.

sbattista09
Contributor

im not getting any new logs into splunk after i set up a new input "file monitor". the CSV has no time stamps so splunk should see the creation date of the file? has anyone ran into this before?

This input worked once and now its not getting this error-
splunkd log-

03-03-2015 09:23:11.015 -0500 WARN  DateParserVerbose - A possible timestamp match (Fri Mar 18 23:01:49 2005) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::\\fileserver\file.CSV|host::list|csv|101514


[monitor://\\fileserver\file]
disabled = false
followTail = 1
host = list
index = index1
crcSalt = <SOURCE>
sourcetype = csv
0 Karma
1 Solution

sbattista09
Contributor

it looks like it was because the file was renamed and added a few times throwing things off. I deleted the files i didn't need in Splunk and that seemed to have solved my problem.

The Directory had two files in it but, Splunk was seeing 4. Ill admit i don't fully understand why the time was getting messed up but everything seems back to normal.

thank you for your time and input rich.

View solution in original post

0 Karma

sbattista09
Contributor

it looks like it was because the file was renamed and added a few times throwing things off. I deleted the files i didn't need in Splunk and that seemed to have solved my problem.

The Directory had two files in it but, Splunk was seeing 4. Ill admit i don't fully understand why the time was getting messed up but everything seems back to normal.

thank you for your time and input rich.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What has changed since the input last worked?

---
If this reply helps you, an upvote would be appreciated.

sbattista09
Contributor

would there bee a way to force splunk to use a date to avoid this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk is supposed to use the file modification time if it cannot find a timestamp in the file contents. That leads me to conclude Splunk is mis-interpreting something in your new CSV file as a timestamp. Look closely at the header and data to see if there is something that resembles a date or time.

---
If this reply helps you, an upvote would be appreciated.

sbattista09
Contributor

it looks like it was because the file was renamed and added a few times throwing things off. I dleted the files i didn't need in Splunk and that seemed to have solved my problem.

The Directory had two files in it bu,t Splunk was seeing 4. Ill admit i don't fully understand why the time was getting messed up but everything seems back to normal.

thank you for your time and input!

0 Karma

sbattista09
Contributor

a new csv file was added, it has the same formatting.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!