Hi,
I have a feed that collects snmp performance stats every 5 minutes. I am parsing this logfile with a heavy forwarder and selectively picking which events that I'm interested in. I keep seeing the following message in my splunkd.log:
12-03-2013 22:40:03.658 -0500 WARN DateParserVerbose - The same timestamp has been used for 400K consecutive times. If more than 200K events have the same timestamp, not all events may be retrieveable. Context: source::/usr/local/nsmutils/export/current/ratedata_vlmmk286.fmr.com_2013-12-03T21-57-33.244|host::vlrtp391|snmp_metrics|
Is the forwarder ignoring events? How can I ensure that all events are being processed?