DateParserVerbose warnings

[Anu]

HI,

I see lot of DateParserverbose warnings in splunkd.log on my indexers.

The errors goes as follows:

WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event

Time parsed (Sun Aug 2 22:06:30 2020) is too far away from the previous event's time (Tue Nov 5 15:47:34 2019) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive

DateParserVerbose - Accepted time format has changed (some random text) possibly indicating a problem in extracting timestamps.

[thambisetty]

take the event from the sourcetype for which you are seeing this error and try to upload using splunk web add data feature to understand if Splunk extracting time as expected. if not you need to define your right TIME_FORMAT in props.conf

[richgalloway]

Splunk detected that the timestamps in that data source are further apart than expected.  There are a couple possible explanations for that.

The data really does have timestamps that are far apart.  If this is expected then you can ignore the warning or change the MAX_DIFF_SECS_AGO setting in props.conf.

Splunk could be parsing the wrong timestamp or interpreting another string as a timestamp.  Review the TIME_PREFIX and TIME_FORMAT settings for the sourcetype in props.conf.

[Anu]

But it was working well from long time.I see this errors from last 1 month.Is there any other reason why this can happen.

[isoutamo]

Have you checked that nobody have changed that log and/or those nodes’ time is still correct?

[Anu]

yes. i'm sure that nobody changed it.@soutamo