Splunk Enterprise

troubleshooting.

whitecat001
Explorer

Am getting a warning of 

  DateParserVerbose - Accepted time (Wed Feb 14 17:01:12 2024) is suspiciously far away from previous event  (Thu jan  18 17:01:12 2024) is still acceptable because it was extracted by the same pattern 

Is there any configuration that can help take this error away in splunk

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Quite possibly there are missing time format on your props.conf. For that reason splunk guess between mm/dd/yyyy and dad/mm/yyyy formats.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make sure the props.conf settings for that sourcetype have the correct time settings.  Specifically, check the TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD values.

Confirm the data source is sending the right events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

whitecat001
Explorer

The first event that came in doesnt have a timestamp which is the reason for the error but the other events are extracted properly

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...