Getting Data In

Disable source timestamp match

craigmunro
Path Finder

Hi

I have a load of warnings in splunkd.log like:

06-15-2011 09:02:23.860 +0100 WARN  DateParserVerbose - A possible timestamp match (14.04.31) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.  Context="source::/opt/app/engine/work/hostname-4/log/engine-4.06.02.2011-14.04.31.log|host::hostname|staging|remoteport::16592"

Everything is getting indexed correctly and I understand from http://www.splunk.com/base/Documentation/4.2.1/Data/HowSplunkextractstimestamps that the timestamp in the log has higher precedence.

How can I stop Splunk from looking at the timestamp in the source name and issuing a warning?

I tried specifying the following in props.conf on the indexer but it hasn't helped.

TIME_FORMAT=%m/%d/%y %H:%M:%S.%3N

Thanks

Tags (1)
0 Karma

craigmunro
Path Finder

This is a workaround to prevent the messages from appearing in the logs:

splunk _internal call /server/logger/DateParserVerbose -post:level ERROR

MarioM
Motivator

did you try to force timestamp with TIME_PREFIX?

marcoscala
Builder

You should have been added
TIME_PREFIX=^

^ meas "start of line".

0 Karma

craigmunro
Path Finder

I tried adding TIME_PREFIX= (ie. timestamp is at start of line) and it didn't have any effect.

My understanding is that that would only affect timestamp extraction from the actual event. Timestamp extraction from the event is working correctly, the warning is being issued as Splunk tries to extract the timestamp from the filename of the log.

0 Karma

MarioM
Motivator

what i meant is by forcing the positionning of the timestamp ,it will stop splunk to look for timestamp elsewhere

craigmunro
Path Finder

No, I didn't. The default TIME_PREFIX is an empty string which is correct for this log and the timestamp is being extracted correctly from the source.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...