DateParserVerbose Warnings

[Anu]

HI,

I see lot of DateParserverbose warnings in splunkd.log on my indexers.

The errors goes as follows:

WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive

DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.

@isoutamo

[richgalloway]

There are two common reasons for that warning.

1. The data has timestamps that vary widely.  If this is expected then you either ignore the warning or change the MAX_DIFF_SECS_AGO and MAX_DIFF_SEC_HENCE settings.

2.  Splunk is using the wrong part of the event as the timestamp.  Double-check the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.

[isoutamo]

Can you share your props.conf and raw event samples before you are ingesting those?

r. Ismo