Getting Data In

Why is DateParserVerbose - timestamp match outside of the acceptable time window?

vrmandadi
Builder

I am seeing this error in my internal logs for some universal forwarders and, interestingly, data is not coming into Splunk from these Universal Forwarders. Below is the sample event for one of the forwarders.

10-31-2018 14:47:49.025 -0400 WARN  DateParserVerbose - The TIME_FORMAT specified is matching timestamps (Mon Sep 24 12:22:03 2018) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log.3|host=EC2AMAZ|splunkd|55

Is there a way to fix this issue and does this cause events dropping into SPLUNK

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...