Getting Data In

Why is DateParserVerbose - timestamp match outside of the acceptable time window?


I am seeing this error in my internal logs for some universal forwarders and, interestingly, data is not coming into Splunk from these Universal Forwarders. Below is the sample event for one of the forwarders.

10-31-2018 14:47:49.025 -0400 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Mon Sep 24 12:22:03 2018) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log.3|host=EC2AMAZ|splunkd|55

Is there a way to fix this issue and does this cause events dropping into SPLUNK

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>