topic Re: datetime.xml 2020 in Dashboards & Visualizations

datetime.xml 2020

riqbal47010 — Tue, 24 Dec 2019 06:55:03 GMT

I am implemented the datetime.xml issue. Now according to article
https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
I want to validate the change.

I create test.csv file as metioned in above link. now how can I upload and validate in my distributed environment.

Re: datetime.xml 2020

kamlesh_vaghela — Tue, 24 Dec 2019 07:07:55 GMT

@riqbal47010

have you check this?

https://www.youtube.com/watch?v=tIcRvw2zx34

Check step 5 in https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020#Validate_timestamp_extraction_after_an_update

Using the Splunk CLI, add the text file you saved earlier as a oneshot monitor to the Splunk platform instance that you want to validate.

$SPLUNK_HOME/bin/splunk add oneshot -source test_file.csv -sourcetype csv -index main

Re: datetime.xml 2020

riqbal47010 — Wed, 30 Sep 2020 03:26:06 GMT

I gone through all the steps but I have distributed environment.
below are performed steps.

following step#3
On Heavy forwarder I create props.conf file under $SPLUNK_HOME/etc/system/local
[default]
MAX_DAYS_HENCE = 40

after that I add file through step#5

but results are not as expected.

the events time is the time when I am uploading the events.

Re: datetime.xml 2020

kamlesh_vaghela — Tue, 24 Dec 2019 10:49:55 GMT

Did you executed step 4??

Just for troubleshooting, is it possible to keep local copy in the HF and execute step 5 again. And just check data on HF only.

I found steps For distributed environment please check below link.

https://blog.zivaro.com/splunk-product-timestamp-issue-solution

Re: datetime.xml 2020

riqbal47010 — Wed, 25 Dec 2019 13:06:31 GMT

hi kamlesh,

thanks fory your kind support.

I check the video link and found that to see the future date I have to select all times

thanks for your support