Getting Data In

Trying to get SNMP data into Splunk, why am I getting error "A possible timestamp match is outside of the acceptable time window"?

Path Finder

I have followed the following links for getting SNMP Data into Splunk:

http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt1/
http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt2

transforms.conf

[snmp_field_extractions]
REGEX=(.+?)::(.+?)\.\"((?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=mib::$1 oid::$2 snmp_index::$3 value::$4
MV_ADD=true

[snmp_keyvalue_extraction]
REGEX=(?:.+?)::(.+?)\.\"(?:(?:\d\.?)+)\"\s=\s\"(.*?)\"\s
FORMAT=$1::$2

[snmp_mib_uid]
REGEX = ([^:]+)::([^\.]+)\.("?)([^"]*)\3 = \"([^\"]*)\"(?= |\n|$)
FORMAT = MIB::$1 UID::$4 Name::$2 $2::$5 Value::$5

props.conf

[snmp_ta]
REPORT-snmpfieldvalues = snmp_field_extractions , snmp_keyvalue_extraction, snmp_mib_uid
DATETIME_CONFIG = NONE

However, I am getting following errors in the splunkd.log:

08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|
08-29-2016 21:34:45.689 +0000 WARN  DateParserVerbose - A possible timestamp match (Sun Sep  9 01:46:40 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://Nexus 6K Stats|host::67.178.30.20|nexus_snmp|

What could be the issue?

Thanks

0 Karma

Splunk Employee
Splunk Employee

Hey jgcsco!

do you have a props.conf entry called nexussnmp that is still running the datetimeparser? If I am not mistaken, the "context" entry in the log points to source, hosts and sourcetype? Which I would expect to see snmpta.

Been a while since I played with the mod input. Will try and confirm in my lab.

0 Karma

Explorer

I guess it's the problem of synchronisation. Please check it in your Splunk and target system.
It looks the timestamps of events are beyond the local time windows of Splunk.

If all the nodes have been synchronised, you can adjust the MAXDAYSAGO in props.conf. The timestamp in your event is in 2001, which is beyond the default scope. Give a bigger time window to MAXDAYSAGO, then Splunk can index it without that message.
Details can be found as below
https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Propsconf

0 Karma