Getting Data In

What does this splunkd.log DateParserVerbose message mean?

Splunk Employee
Splunk Employee

10-21-2010 09:19:40.631 WARN DateParserVerbose - Time parsed (Thu Oct 21 09:19:38 2010) is too far away from the previous event's time (Fri Oct 1 07:42:46 2010) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive.

Clearly, this is saying that there is an issue with splunk recognizing the timestamp or it believing that the event might have a wrong timestamp, however what really happens to this event?

Does it not get indexed? (too far away to be accepted)
Does it get indexed with a different timestamp, or since this is just a warning it still gets indexed with this timestamp but splunk just wants to notify us?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp.

If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - MAX_DIFF_SECS_AGO or MAX_DIFF_SECS_HENCEin props.conf

View solution in original post

Splunk Employee
Splunk Employee

Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp.

If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - MAX_DIFF_SECS_AGO or MAX_DIFF_SECS_HENCEin props.conf

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!