topic Re: UF and Platform version level compatibility with new timestamp issue in Getting Data In

UF and Platform version level compatibility with new timestamp issue

jeffbat — Mon, 25 Nov 2019 18:11:16 GMT

Just got the notification about the timestamp issue coming in Jan 2020.

I am currently running 7.2.4.2 across my Indexers/Search Heads/Heavy Forwarders. I see that I can just change out the datetime.xml file on them to resolve the issue.

My main question is around the Universal Forwarder level, with my backend being 7.2.4; can I upgrade my forwarders to 7.2.9.1 and there be no issue? We are running a mixture of 6.6.3 and 7.2.4.2 forwarders now. I will be difficult for us to put in a change for our backend infrastructure of Splunk to 7.2.9.1 so changing the file out makes sense but we likely can get the forwarders set to be upgraded if there will not be any compatibility issues with it talking to a lower minor version.

thanks for any information.

Re: UF and Platform version level compatibility with new timestamp issue

satyenshah — Mon, 25 Nov 2019 18:19:39 GMT

Yes, version 7.2.9.1 forwarders are compatible with 7.2.4 indexers:
https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers

We have a mix of UF versions ranging from 7.0 to 8.0.0, alongside indexers that have been are frequently updated, and have never run into an indexer-compatibility issue.

At the same time, you can get away without doing anything to the UFs, since the timestamp extraction / cooking of data happens downstream of the UF.

Re: UF and Platform version level compatibility with new timestamp issue

jeffbat — Mon, 25 Nov 2019 18:46:32 GMT

That is what I thought, thanks.

Re: UF and Platform version level compatibility with new timestamp issue

lmichalski_2 — Tue, 26 Nov 2019 09:58:03 GMT

Could you add -f flag for copy inside scripts? Actually copying did not work for me, because original datetime.xml can have permissions=444. Without flag -f cp can return Permission denied. Or another way - chmod temporarily /opt/splunkforwarder/etc/datetime.xml to 644

I don't know yet if similar thing is needed for Windows UF
2. According to this https://stackoverflow.com/a/38285462 , could you add permissions for executing?

Re: UF and Platform version level compatibility with new timestamp issue

satyenshah — Wed, 27 Nov 2019 14:35:24 GMT

I fatfingered cp -rp by habit. Changed to cp -f. Thanks for the heads up!