HI,
I see lot of DateParserverbose warnings in splunkd.log on my indexers.
The errors goes as follows:
WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event
Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive
DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.
There are two common reasons for that warning.
1. The data has timestamps that vary widely. If this is expected then you either ignore the warning or change the MAX_DIFF_SECS_AGO and MAX_DIFF_SEC_HENCE settings.
2. Splunk is using the wrong part of the event as the timestamp. Double-check the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.
Can you share your props.conf and raw event samples before you are ingesting those?
r. Ismo