Getting Data In

DateParserVerbose Warnings



I see lot of DateParserverbose warnings in splunkd.log on my indexers.

The errors goes as follows:

WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive


DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.


Labels (1)
0 Karma


There are two common reasons for that warning.

1. The data has timestamps that vary widely.  If this is expected then you either ignore the warning or change the MAX_DIFF_SECS_AGO and MAX_DIFF_SEC_HENCE settings.

2.  Splunk is using the wrong part of the event as the timestamp.  Double-check the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.

If this reply helps you, an upvote would be appreciated.
0 Karma


Can you share your props.conf and raw event samples before you are ingesting those?

r. Ismo

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!