What does this splunkd.log DateParserVerbose message mean?

[Genti]

10-21-2010 09:19:40.631 WARN DateParserVerbose - Time parsed (Thu Oct 21 09:19:38 2010) is too far away from the previous event's time (Fri Oct 1 07:42:46 2010) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive.

Clearly, this is saying that there is an issue with splunk recognizing the timestamp or it believing that the event might have a wrong timestamp, however what really happens to this event?

Does it not get indexed? (too far away to be accepted)
Does it get indexed with a different timestamp, or since this is just a warning it still gets indexed with this timestamp but splunk just wants to notify us?

[Mick · Accepted solution]

Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp.

If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - MAX_DIFF_SECS_AGO or MAX_DIFF_SECS_HENCEin props.conf