Getting Data In

What does this splunkd.log DateParserVerbose message mean?

Genti
Splunk Employee
Splunk Employee

10-21-2010 09:19:40.631 WARN DateParserVerbose - Time parsed (Thu Oct 21 09:19:38 2010) is too far away from the previous event's time (Fri Oct 1 07:42:46 2010) to be accepted. If this is a correct time, MAX_DIFF_SECS_AGO (3600) or MAX_DIFF_SECS_HENCE (604800) may be overly restrictive.

Clearly, this is saying that there is an issue with splunk recognizing the timestamp or it believing that the event might have a wrong timestamp, however what really happens to this event?

Does it not get indexed? (too far away to be accepted)
Does it get indexed with a different timestamp, or since this is just a warning it still gets indexed with this timestamp but splunk just wants to notify us?

Tags (1)
1 Solution

Mick
Splunk Employee
Splunk Employee

Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp.

If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - MAX_DIFF_SECS_AGO or MAX_DIFF_SECS_HENCEin props.conf

View solution in original post

Mick
Splunk Employee
Splunk Employee

Your second suspicion is correct, the event will be indexed with a different timestamp - the one identifed in the events preceding the 'problem' timestamp.

If you are actually indexing historical data at the same time as current data, then you should ensure that let Splunk know this by using the settings identified in the event - MAX_DIFF_SECS_AGO or MAX_DIFF_SECS_HENCEin props.conf

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...