Getting Data In

how to handle thousands of events with the same timestamp...

a212830
Champion

Hi,

I have a feed that collects snmp performance stats every 5 minutes. I am parsing this logfile with a heavy forwarder and selectively picking which events that I'm interested in. I keep seeing the following message in my splunkd.log:

12-03-2013 22:40:03.658 -0500 WARN DateParserVerbose - The same timestamp has been used for 400K consecutive times. If more than 200K events have the same timestamp, not all events may be retrieveable. Context: source::/usr/local/nsmutils/export/current/ratedata_vlmmk286.fmr.com_2013-12-03T21-57-33.244|host::vlrtp391|snmp_metrics|

Is the forwarder ignoring events? How can I ensure that all events are being processed?

hettervik
Builder

I've encountered some serious performance issues when a lot of events have the exact same time stamp in a search, so I think "forcing" Splunk to index a lot of events with the same timestamp would be a bad idea. That being said, how are you setting the timestamp on the events, extracting it from the raw events, setting it on index time, or using the timestamp from the file name? If the latter is the case, you could try using the timestamps from the raw events (if any) or set DATETIME_CONFIG=CURRENT in props to set a timestamp at the time of indexing.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...