Getting Data In

timestamp is outside of acceptable window

rvisj
New Member

I have a field in .csv file that have future dates. while uploading to Splunk, it shows the below error message and don't show any record after uploading.
Future dates are must to show. The field containing future dates is 'Start_Time' which is also _time. I am using that _time in my query also.

.alt text

Any suggestion will be helpful!

0 Karma

rjthibod
Champion

The solution as the tooltip suggests is to increase the MAX_DAYS_HENCE setting in your props.conf file.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Timestamp_extraction_configurati...

Note, this can be source, sourcetype, or host specific.

rvisj
New Member

I increased MAX_DAYS_HENCE to 20 days in props.config. But the result is still same, it is not reflecting, I closed Splunk and open it again. My data is one week ahead of current date.

0 Karma

rjthibod
Champion

Sorry for the delay. Was out on vacation.

Did you restart Splunk or just close the browser?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...