Getting Data In

Why is DateParserVerbose - timestamp match outside of the acceptable time window?


I am seeing this error in my internal logs for some universal forwarders and, interestingly, data is not coming into Splunk from these Universal Forwarders. Below is the sample event for one of the forwarders.

10-31-2018 14:47:49.025 -0400 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Mon Sep 24 12:22:03 2018) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log.3|host=EC2AMAZ|splunkd|55

Is there a way to fix this issue and does this cause events dropping into SPLUNK

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!