DateParserVerbose - what is splunkd.log telling me?

[mctester]

I'm trying to figure out what the number is at the end of the following internal DateParserVerbose log. Sometimes a number is there and sometimes not, sometimes a "\n"

04-20-2015 07:56:51.991 -0400 WARN DateParserVerbose - Time parsed (Mon Apr 20 04:17:19 2015) is too far away from the previous event's time (Mon Apr 20 07:56:40 2015) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive. Context: source::/var/log/host/cronlog|host::homer|cronlog-2|96256

[Mick · Accepted solution]

What we have here is an internal identifier that we call the 'pipelinechannelset' and is used to ensure that data from a particular input stream is not mingled with data from another stream. This is primarily used for network inputs where we would have incoming streams from multiple sources via the same TCP port, 9997 by default.

In the case of local file inputs, it's not necessary to have an identifier like this as our default parsing machinery already has the ability to keep data from different files separate - so that explains why you will sometimes see '/n' versus a number.

The more incoming data-streams you have (i.e. the more forwarders in your deployment), the higher this number will be.

[martin_mueller]

So... don't cross the streams?

[Mick]

This comment deserves way more karma than I can currently allocate