topic Re: Timestamp recognition issue in Getting Data In

Timestamp recognition issue

santosh11 — Wed, 30 Sep 2020 03:27:28 GMT

Dear All,

We are getting notification of from splunk on time stamp recognition issue from jan 1 2010 it will be effecting the splunk in premise servers as splunk cloud will be taken care by splunk team.

So i perform below steps will it be fine?

1) Download the datetime.zip timestamp recognition ZIP file from splunk.com.
2) Unarchive the ZIP file to a location that is accessible from all of your Splunk platform instances.
On each Splunk platform instance, do the following:
Using your operating system file management utilities, copy the updated datetime.xml from the location where you downloaded it to the $SPLUNK_HOME/etc directory on the Splunk platform instance. Ensure that the updated file overwrites the existing file.
Confirm that the new datetime.xml has been written to the $SPLUNK_HOME/etc directory.
Restart the Splunk platform. Your Splunk platform instance is now patched.

Because we have to perform on production system so just want a confirmation?

Regards,
Santosh

Re: Timestamp recognition issue

richgalloway — Wed, 18 Dec 2019 15:57:05 GMT

Those are the documented steps. If you have doubts, you should test them on a non-production system (even if it means installing Splunk on your workstation).

Re: Timestamp recognition issue

woodcock — Wed, 18 Dec 2019 20:20:16 GMT

I used the "app" method because we have a Deployment Server. It is the easiest way but the *.zip download is NOT an app, it is a package of TWO distinct apps that go to TWO separate serverclasses.

Re: Timestamp recognition issue

santosh11 — Wed, 30 Sep 2020 03:27:44 GMT

We have tested this in our local environment and it is working.

But in this we have one setting in props.conf

MAX_DAYS_HENCE = 40

Is it like from the day it expires it will work only till next 40 days.?

Can you please explain me about this "Max_DAYS_HENCE" i went through the document can anyone please explain it. I got bit confused and i need to perform these changes into splunk production?

Regards,
Santosh

Re: Timestamp recognition issue

richgalloway — Thu, 19 Dec 2019 13:51:32 GMT

In this context, MAX_DAYS_HENCE is used to test the datetime.xml fix. It can be removed (or returned to the previous value) when testing is complete.

In general, MAX_DAYS_HENCE tells Splunk how to treat timestamps that are newer than today. Those that are fewer than MAX_DAYS_HENCE in the future are accepted; others are not.