Trying to get SNMP data into Splunk, why am I getting error "A possible timestamp match is outside of the acceptable time window"?

[jgcsco]

I have followed the following links for getting SNMP Data into Splunk:

http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt1/
http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt2

transforms.conf

[snmp_field_extractions]
REGEX=(.+?)::(.+?)\.\"((?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=mib::$1 oid::$2 snmp_index::$3 value::$4
MV_ADD=true

[snmp_keyvalue_extraction]
REGEX=(?:.+?)::(.+?)\.\"(?:(?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=$1::$2

[snmp_mib_uid]
REGEX = ([^:]+)::([^\.]+)\.("?)([^"]*)\3 = \"([^\"]*)\"(?= |\n|$)
FORMAT = MIB::$1 UID::$4 Name::$2 $2::$5 Value::$5

props.conf

[snmp_ta]
REPORT-snmpfieldvalues = snmp_field_extractions , snmp_keyvalue_extraction, snmp_mib_uid
DATETIME_CONFIG = NONE

However, I am getting following errors in the splunkd.log:

08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|

What could be the issue?

Thanks

[mattymo]

Hey jgcsco!

do you have a props.conf entry called nexus_snmp that is still running the datetimeparser? If I am not mistaken, the "context" entry in the log points to source, hosts and sourcetype? Which I would expect to see snmp_ta.

Been a while since I played with the mod input. Will try and confirm in my lab.

[ChrisYang]

I guess it's the problem of synchronisation. Please check it in your Splunk and target system.
It looks the timestamps of events are beyond the local time windows of Splunk.

If all the nodes have been synchronised, you can adjust the MAX_DAYS_AGO in props.conf. The timestamp in your event is in 2001, which is beyond the default scope. Give a bigger time window to MAX_DAYS_AGO, then Splunk can index it without that message.
Details can be found as below
https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Propsconf