PROPS Configuration file for data sources with timestamp more than 10 years

[SplunkDash]

Hello,

I am getting some error messages within my PROPS Configuration file to parse timestamp data. The sample file/event, my props configuration, and error message are giving below. Any help will be highly appreciated. Thank you so much:

Sample Event:

<?xml version="1.0" encoding="ISO99991"?>

<SDWDATA>

<MDWDATA>

<TIMESTAMP>20110630143000</TIMESTAMP> 

 <USERTYPE>TEST</USERTYPE>

<SESSION>zx530</SESSION>

<IPADDR>142.225.163.60</IPADDR>

<SYSTEM>CDE</SYSTEM>

<EVENTID>NAMEE</EVENTID> <EVENTTYPE>SEARCH</EVENTTYPE>

<RETURNCODE>0102</RETURNCODE>

<ERRORMSG>None</ERRORMSG>

<ESTATCD>1</ESTATCD>

<TESTCODE>210</TESTCODE>

<FNUMBER>1321</FNUMBER>

<OUTPUTCODE>10</OUTPUTCODE>

<RCODE>ASDC</RCODE>

<NAMECTRL>TESTPWE</NAMECTRL>

<USERID>I00XY09</USERID>

<ACCESS>ngd</ACCESS>

<CAMPUSCODE>p</CAMPUSCODE>

<SRCCD>ab31</SRCCD>

<SLNR>123456</SLNR>

</MDWDATA>

<SDWDATA>

PROPS:

[ __auto__learned__ ]

SHOULD_LINEMERGE=true

LINE_BREAKER=([\r\n]*)<MODTRANSAUDTRL>

TIME_PREFIX=<TIMESTAMP>

TIME_FORMAT=%Y%m%d%H%M%S

MAX_TIMESTAMP_LOOKAHEAD=14

TRUNCATE=1000

ERROR Message:

[PickleRick · Accepted solution]

The error should be quite self-explanatory. And the proposed solution as well.

Your date is from 2011, which is more than default 5.5 years ago limit.

Adjust your MAX_DAYS_AGO setting.