Getting Data In

Why is DateParserVerbose - timestamp match outside of the acceptable time window?


I am seeing this error in my internal logs for some universal forwarders and, interestingly, data is not coming into Splunk from these Universal Forwarders. Below is the sample event for one of the forwarders.

10-31-2018 14:47:49.025 -0400 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Mon Sep 24 12:22:03 2018) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log.3|host=EC2AMAZ|splunkd|55

Is there a way to fix this issue and does this cause events dropping into SPLUNK

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...