Getting Data In
Highlighted

timestamp is outside of acceptable window

New Member

I have a field in .csv file that have future dates. while uploading to Splunk, it shows the below error message and don't show any record after uploading.
Future dates are must to show. The field containing future dates is 'Start_Time' which is also _time. I am using that _time in my query also.

.alt text

Any suggestion will be helpful!

0 Karma
Highlighted

Re: timestamp is outside of acceptable window

Champion

The solution as the tooltip suggests is to increase the MAXDAYSHENCE setting in your props.conf file.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Timestamp_extraction_configurati...

Note, this can be source, sourcetype, or host specific.

Highlighted

Re: timestamp is outside of acceptable window

New Member

I increased MAXDAYSHENCE to 20 days in props.config. But the result is still same, it is not reflecting, I closed Splunk and open it again. My data is one week ahead of current date.

0 Karma
Highlighted

Re: timestamp is outside of acceptable window

Champion

Sorry for the delay. Was out on vacation.

Did you restart Splunk or just close the browser?

0 Karma