Getting Data In

A possible timestamp match outside of the acceptable time window.

jethro_yb
Engager

06-27-2013 15:30:06.733 +0800 WARN DateParserVerbose - A possible timestamp match (Wed May 10 07:48:27 2000) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::dm_altKpiRAM|host::head2|dm_altKpiRAM|

what's this log mean?
anyone help?

Tags (2)
0 Karma

dmlee
Communicator

it means, your event is long long time ago (2000/05/10 ) , exceed MAX_DAYS_AGO ( default 2000 days ) in props.conf , so Splunk warning you , you should check if the time extract setting is correct or not , or you should amend the props.conf to increase MAX_DAYS_AGO ( from 2000 to 4745 e.g.)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...