Getting Data In
Highlighted

timestamp match is outside of the acceptable time window

Path Finder

Hello,
I have a log with a timestamp that does not contain the year.
Moreover the events are not in a chronological order.

Here is a sample:
%symavsfs-4: Thu Mar 08 12:16:23 Romance Standard
%symavsfs-4: Thu Mar 08 12:18:25 Romance Standard
%symavsfs-4: Fri Dec 15 00:12:45 Romance Standard
%symavsfs-4: Fri Dec 15 00:17:50Romance Standard

The timestamp extraction gives an error:
A possible timestamp match (Thu Mar 08 12:16:23 2019) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAXDAYSAGO and MAXDAYSHENCE.

I try to put MAXDAYSAGO to 2000 (but it is supposed to be set by default), and MAXDIFFSECS_AGO to 31536000 (1 year in second).
But the extraction is still not correct.
Splunk understands that the events are in the future.

Does anyone know how to force Splunk to consider that the events are in the past, either in 2018 or in 2017 ?

Regards
Céline

Tags (2)
0 Karma
Highlighted

Re: timestamp match is outside of the acceptable time window

Champion

Can you try changing MAXDAYSHENCE= 10950 . Also try using TIME_FORMAT parameter.

0 Karma
Highlighted

Re: timestamp match is outside of the acceptable time window

Path Finder

Hello,
Thansk for your reply.
But it is not working.
Finally I have seen that the event contains the year,
then I have used TIME_FORMAT : %a %b %d %H:%M:%S Romance Standard Time %Y

%symavsfs-4: Thu Mar 08 12:16:23 Romance Standard 2018
%symavsfs-4: Thu Mar 08 12:18:25 Romance Standard 2918
%symavsfs-4: Fri Dec 15 00:12:45 Romance Standard 2017
%symavsfs-4: Fri Dec 15 00:17:50 Romance Standard 2017

But it is worst. the year of the timestamp is completely and Splunk changes the year with 2012, 2013 ...with a Strange algorithm.

Regards

0 Karma