topic Re: Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud? in Getting Data In

Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

jgaccornero — Thu, 19 Dec 2019 14:16:36 GMT

We use Splunk Cloud and have 3 Heavy Forwarders (which I updated yesterday with the new datetime.xml). We also have about 10 universal fowarders (most of them on Windows). Do I need to apply the datetime.xml to those as well?

thanks!

Re: Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

richgalloway — Wed, 30 Sep 2020 03:27:55 GMT

There are a couple of conditions where updating datetime.xml on UFs is required:

When they have been configured to process structured data, such as CSV, XML, and JSON files, using the INDEXED_EXTRACTIONS setting in props.conf
When they have been configured to process data locally, using the force_local_processing setting in props.conf

If these conditions don't apply, it's not a bad idea to update datetime.xml anyway.

Re: Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

jgaccornero — Thu, 19 Dec 2019 14:59:58 GMT

Ok, thank you! I will go ahead and update them.

Thanks again!
Jon