06-30-2022 14:05:59.555 -0600 WARN DateParserVerbose [1556614 merging] - The TIME_FORMAT specified is matching timestamps (Tue Jun 6 17:43:20 2023) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=/path/to/log|host=UF01|new_sourcetype|230
I'm confused where "(Tue Jun 6 17:43:20 2023)" is coming from because none of the logs have this string.
How do I approach this? I've thought about using transforms to write into the DEST_KEY "_time" but I read that any key starting with "_" is not indexed. This data is being received from a syslog server so I thought about modifying the data as it's being received. What are you recommendations?