Disable source timestamp match

[craigmunro]

Hi

I have a load of warnings in splunkd.log like:

06-15-2011 09:02:23.860 +0100 WARN  DateParserVerbose - A possible timestamp match (14.04.31) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.  Context="source::/opt/app/engine/work/hostname-4/log/engine-4.06.02.2011-14.04.31.log|host::hostname|staging|remoteport::16592"

Everything is getting indexed correctly and I understand from http://www.splunk.com/base/Documentation/4.2.1/Data/HowSplunkextractstimestamps that the timestamp in the log has higher precedence.

How can I stop Splunk from looking at the timestamp in the source name and issuing a warning?

I tried specifying the following in props.conf on the indexer but it hasn't helped.

TIME_FORMAT=%m/%d/%y %H:%M:%S.%3N

Thanks

[craigmunro]

This is a workaround to prevent the messages from appearing in the logs:

splunk _internal call /server/logger/DateParserVerbose -post:level ERROR

[MarioM]

did you try to force timestamp with TIME_PREFIX?

[marcoscala]

You should have been added
TIME_PREFIX=^

^ meas "start of line".

[craigmunro]

I tried adding TIME_PREFIX= (ie. timestamp is at start of line) and it didn't have any effect.

My understanding is that that would only affect timestamp extraction from the actual event. Timestamp extraction from the event is working correctly, the warning is being issued as Splunk tries to extract the timestamp from the filename of the log.

[MarioM]

what i meant is by forcing the positionning of the timestamp ,it will stop splunk to look for timestamp elsewhere

[craigmunro]

No, I didn't. The default TIME_PREFIX is an empty string which is correct for this log and the timestamp is being extracted correctly from the source.