×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
kst
Explorer
Member since: ‎04-20-2011
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎04-20-2011
View All

Re: DateParserVerbose - timestamp match is outside...

by in Getting Data In
‎03-07-2012 11:45 AM
‎03-07-2012 11:45 AM
We went from 4.2.3 to 4.3 about a month prior to this, on the indexer that is having the issue. Vast majority of the forwarders are still on 4.2.x. I've also opened a call with support. ... View more

Re: DateParserVerbose - timestamp match is outside...

by in Getting Data In
‎03-07-2012 07:11 AM
‎03-07-2012 07:11 AM
Seeing the same thing here -- splunkd.log FILLS with this warning, from a variety of forwarders, to our v4.3 indexer. I'm seeing both "possible timestamp match (Tue mar 6 14:50:43 2012)" and "possible timestamp match (03-06-2012)" (note the differing timestamp formats) from various hosts that are forwarding to this indexer. As the others have said, the timestamp it is complaining about is within a second of the error timestamp itself. ... View more

Re: How do I block one forwarder from sending?

by in Getting Data In
‎02-03-2012 06:48 AM
1 Karma
‎02-03-2012 06:48 AM
1 Karma
Thanks for the answers. FWIW, these were IIS logs being written to the default index. I used iptables to shut 'em down. ... View more

How do I block one forwarder from sending?

by in Getting Data In
‎02-03-2012 04:45 AM
1 Karma
‎02-03-2012 04:45 AM
1 Karma
I have an indexer getting data from 24 hosts. We were well within our quota until two hosts were added that, for whatever reason (misconfiguration, extremely busy, etc.) are sending many GB. I have no control over these forwarders, I have to wait for their admins to fix/reconfigure them. To keep from going over quota, I've disabled port 9997 on the indexer until I can touch base with those admins. But is there a way to stop accepting data from just those two offenders without shutting off the other 24 forwarders? I'm at version 4.3, if that matters. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
View All