Getting Data In

DateParserVerbose - what is splunkd.log telling me?

mctester
Communicator

I'm trying to figure out what the number is at the end of the following internal DateParserVerbose log. Sometimes a number is there and sometimes not, sometimes a "\n"

04-20-2015 07:56:51.991 -0400 WARN DateParserVerbose - Time parsed (Mon Apr 20 04:17:19 2015) is too far away from the previous event's time (Mon Apr 20 07:56:40 2015) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive. Context: source::/var/log/host/cronlog|host::homer|cronlog-2|96256
1 Solution

Mick
Splunk Employee
Splunk Employee

What we have here is an internal identifier that we call the 'pipelinechannelset' and is used to ensure that data from a particular input stream is not mingled with data from another stream. This is primarily used for network inputs where we would have incoming streams from multiple sources via the same TCP port, 9997 by default.

In the case of local file inputs, it's not necessary to have an identifier like this as our default parsing machinery already has the ability to keep data from different files separate - so that explains why you will sometimes see '/n' versus a number.

The more incoming data-streams you have (i.e. the more forwarders in your deployment), the higher this number will be.

View solution in original post

Mick
Splunk Employee
Splunk Employee

What we have here is an internal identifier that we call the 'pipelinechannelset' and is used to ensure that data from a particular input stream is not mingled with data from another stream. This is primarily used for network inputs where we would have incoming streams from multiple sources via the same TCP port, 9997 by default.

In the case of local file inputs, it's not necessary to have an identifier like this as our default parsing machinery already has the ability to keep data from different files separate - so that explains why you will sometimes see '/n' versus a number.

The more incoming data-streams you have (i.e. the more forwarders in your deployment), the higher this number will be.

martin_mueller
SplunkTrust
SplunkTrust

So... don't cross the streams?

Mick
Splunk Employee
Splunk Employee

This comment deserves way more karma than I can currently allocate

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...