Hi All,
We are receiving below timestamp issues,
0000 WARN DateParserVerbose [104706 merging_0] - Accepted time format has changed ((?i)(?<![\d\.])(20\d\d)([-/])([01]?\d)\2([012]?\d|3[01])\s+([012]?\d):([0-6]?\d):([0-6]?\d)\s*(?i)((?:(?:UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?), possibly indicating a problem in extracting timestamp
12-27-2021 14:33:04.972 +0000 WARN DateParserVerbose [104095 merging_0] - Accepted time format has changed ((?i)(?<![\w\.])(?i)(?i)(0?[1-9]|[12]\d|3[01])(?:st|nd|rd|th|[,\.;])?([\- /]) {0,2}(?i)(?:(?i)(?<![\d\w])(jan|\x{3127}\x{6708}|feb|\x{4E8C}\x{6708}|mar|\x{4E09}\x{6708}|apr|\x{56DB}\x{6708}|may|\x{4E94}\x{6708}|jun|\x{516D}\x{6708}|jul|\x{4E03}\x{6708}|aug|\x{516B}\x{6708}|sep|\x{4E5D}\x{6708}|oct|\x{5341}\x{6708}|nov|\x{5341}\x{3127}\x{6708}|dec|\x{5341}\x{4E8C}\x{6708})[a-z,\.;]*|(?i)(0?[1-9]|1[012])(?!:))\2 {0,2}(?i)(20\d\d|19\d\d|[9012]\d(?!\d))(?![\w\.])), possibly indicating a problem in extracting timestamps
All the Linux servers that are sending logs to Splunk are in EST timezone and we are expecting the same timezone to be indexed at. But we are still seeing issues not able to identify which of the servers are causing timezone issues. Is there any other checks we need to perform to solve the above errors.
Thanks,
Sharada
