Getting Data In

Trying to get SNMP data into Splunk, why am I getting error "A possible timestamp match is outside of the acceptable time window"?

jgcsco
Path Finder

I have followed the following links for getting SNMP Data into Splunk:

http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt1/
http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt2

transforms.conf

[snmp_field_extractions]
REGEX=(.+?)::(.+?)\.\"((?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=mib::$1 oid::$2 snmp_index::$3 value::$4
MV_ADD=true

[snmp_keyvalue_extraction]
REGEX=(?:.+?)::(.+?)\.\"(?:(?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=$1::$2

[snmp_mib_uid]
REGEX = ([^:]+)::([^\.]+)\.("?)([^"]*)\3 = \"([^\"]*)\"(?= |\n|$)
FORMAT = MIB::$1 UID::$4 Name::$2 $2::$5 Value::$5

props.conf

[snmp_ta]
REPORT-snmpfieldvalues = snmp_field_extractions , snmp_keyvalue_extraction, snmp_mib_uid
DATETIME_CONFIG = NONE

However, I am getting following errors in the splunkd.log:

08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|

What could be the issue?

Thanks

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hey jgcsco!

do you have a props.conf entry called nexus_snmp that is still running the datetimeparser? If I am not mistaken, the "context" entry in the log points to source, hosts and sourcetype? Which I would expect to see snmp_ta.

Been a while since I played with the mod input. Will try and confirm in my lab.

- MattyMo
0 Karma

ChrisYang
Explorer

I guess it's the problem of synchronisation. Please check it in your Splunk and target system.
It looks the timestamps of events are beyond the local time windows of Splunk.

If all the nodes have been synchronised, you can adjust the MAX_DAYS_AGO in props.conf. The timestamp in your event is in 2001, which is beyond the default scope. Give a bigger time window to MAX_DAYS_AGO, then Splunk can index it without that message.
Details can be found as below
https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Propsconf

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!