https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496378#M84673 <P>Is there a way to check which hosts (universal forwarders or splunk enterprise) have the updated datetime.xml installed?<BR /> We have several different groups that send us logs from an internal network via a heavy forwarder, so I can see their splunkd logs, but there seems to be no record of the new file.<BR /> On the heavy installs, It reports properly.<BR /> On the universal forwarders, I was hoping that it would fail the file validation at startup and send the log to _internal, but even though "splunk.exe validate files" shows there is a change, nothing shows up in the splunkd log or at startup.</P> <P>I am trying to generate a list of all hosts that do not have the file installed.</P> <P>I realize that this timestamp issue may not affect certain log types, but we are not in a position to pick/choose which ones will work, so our strategy will be to apply the workaround to 100% of the instances.</P> Tue, 03 Dec 2019 19:32:55 GMT oliverj 2019-12-03T19:32:55Z https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496378#M84673 <P>Is there a way to check which hosts (universal forwarders or splunk enterprise) have the updated datetime.xml installed?<BR /> We have several different groups that send us logs from an internal network via a heavy forwarder, so I can see their splunkd logs, but there seems to be no record of the new file.<BR /> On the heavy installs, It reports properly.<BR /> On the universal forwarders, I was hoping that it would fail the file validation at startup and send the log to _internal, but even though "splunk.exe validate files" shows there is a change, nothing shows up in the splunkd log or at startup.</P> <P>I am trying to generate a list of all hosts that do not have the file installed.</P> <P>I realize that this timestamp issue may not affect certain log types, but we are not in a position to pick/choose which ones will work, so our strategy will be to apply the workaround to 100% of the instances.</P> Tue, 03 Dec 2019 19:32:55 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496378#M84673 oliverj 2019-12-03T19:32:55Z https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496379#M84674 <P>Any suggestions here?<BR /> Having a hard time coming up with a verification method.</P> Thu, 05 Dec 2019 14:21:17 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496379#M84674 oliverj 2019-12-05T14:21:17Z https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496380#M84675 <P>Deployment server can produce a list of Splunk versions for UF/Splunk which can indicate that the endpoint being on a non patch UF. </P> Fri, 06 Dec 2019 20:36:28 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496380#M84675 ycefalas 2019-12-06T20:36:28Z https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496381#M84676 <P>Yes, but in our case, we only updated the XML. <BR /> Software updates would be better, but the release turnaround in our environment is prohibitively slow for an emergency like this.</P> Mon, 09 Dec 2019 17:06:50 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496381#M84676 oliverj 2019-12-09T17:06:50Z https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496382#M84677 <P>Per Splunk support, the universal forwarders do not generate a usable message in their logs, although the heavy/full versions do.<BR /> It is possible to build a script that you can install as an app that will to a checksum check, but we are not in a position to install apps across devices we do not own.<BR /> So, manual checks it is.</P> Wed, 11 Dec 2019 14:08:36 GMT https://community.splunk.com/t5/Getting-Data-In/Reporting-clients-with-the-timestamp-workaround-datetime-xml/m-p/496382#M84677 oliverj 2019-12-11T14:08:36Z