WARN DateParserVerbose in splunkd.log - How do i find out which host?

[gfriedmann]

I am seeing DateParserVerbose messages that say the matched timestamp is not cool, but the matched timestamp appears to be that moment.

For example, notice the time of the log message and timestamp mentioned.

01-29-2011 00:10:54.403 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:10:53 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.
01-29-2011 00:10:59.402 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:10:58 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.
01-29-2011 00:11:01.463 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:11:01 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.
01-29-2011 00:11:07.586 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Sat Jan 29 00:11:06 2011) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE.

Can anyone offer advice for tracking down the problem source? I have too many events to go looking for that exact timestamp. Maybe there is some debugging i can put to DateParserVerbose?

[mfrost8]

On the version we're running, 4.2.3, those events have a field at the end that looks like:

Context="source::SOURCE|host::HOST|SOURCETYPE|remoteport::PORT"

I didn't see what version of Splunk you're using, but perhaps this is something that was added to the latest versions of Splunk?