https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503062#M46145 <P>The sha256sum of the patched datetime.xml file is this:</P> <PRE><CODE>[root@ip-10-202-22-128 all_date_patch_props]# sha256sum datetime.xml e6016245a677bff48ea7ddbe8d4b36f9acbd02918e1f90ead812892692d655ea datetime.xml </CODE></PRE> <P>So I create a simple bash script (let's call it datetime_check.sh):</P> <PRE><CODE>sha256sum $SPLUNK_HOME/etc/datetime.xml sha256sum $SPLUNK_HOME/etc/apps/all_date_patch_props/datetime.xml sha256sum $SPLUNK_HOME/etc/slave_apps/idxc_date_patch_props/local/datetime.xml </CODE></PRE> <P>This checks the three main locations that it might be (assuming the default app names) and generates the sum.</P> <P>Then, make an inputs.conf:</P> <PRE><CODE>[script://$SPLUNK_HOME/etc/apps/search/bin/datetime_check.sh] disabled = false index = main interval = 3600 source = datetime_check sourcetype = datetime_check </CODE></PRE> <P>Then you can simply search for all the sums and use stats to track deployment progress.</P> Tue, 10 Dec 2019 17:57:53 GMT asherer_splunk 2019-12-10T17:57:53Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503061#M46144 <P>I've seen the notes about the patch that needs to be applied for the two-digit years in timestamps:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020">https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020</A></P> <P>How do I do a quick-spot check of all my forwarders and full instances to make sure that datetime.xml has been patched?</P> Tue, 10 Dec 2019 17:49:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503061#M46144 asherer_splunk 2019-12-10T17:49:52Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503062#M46145 <P>The sha256sum of the patched datetime.xml file is this:</P> <PRE><CODE>[root@ip-10-202-22-128 all_date_patch_props]# sha256sum datetime.xml e6016245a677bff48ea7ddbe8d4b36f9acbd02918e1f90ead812892692d655ea datetime.xml </CODE></PRE> <P>So I create a simple bash script (let's call it datetime_check.sh):</P> <PRE><CODE>sha256sum $SPLUNK_HOME/etc/datetime.xml sha256sum $SPLUNK_HOME/etc/apps/all_date_patch_props/datetime.xml sha256sum $SPLUNK_HOME/etc/slave_apps/idxc_date_patch_props/local/datetime.xml </CODE></PRE> <P>This checks the three main locations that it might be (assuming the default app names) and generates the sum.</P> <P>Then, make an inputs.conf:</P> <PRE><CODE>[script://$SPLUNK_HOME/etc/apps/search/bin/datetime_check.sh] disabled = false index = main interval = 3600 source = datetime_check sourcetype = datetime_check </CODE></PRE> <P>Then you can simply search for all the sums and use stats to track deployment progress.</P> Tue, 10 Dec 2019 17:57:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503062#M46145 asherer_splunk 2019-12-10T17:57:53Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503063#M46146 <P>Hi Asherer,</P> <P>In your answer you check the datetime.xml check-sum (i.e sha256sum) in three locations</P> <P>sha256sum $SPLUNK_HOME/etc/datetime.xml<BR /> sha256sum $SPLUNK_HOME/etc/apps/all_date_patch_props/datetime.xml<BR /> sha256sum $SPLUNK_HOME/etc/slave_apps/idxc_date_patch_props/local/datetime.xml</P> <P>is this location same for Deployment server, Search Head server, Indexer server and Universal forwarder server???</P> Wed, 30 Sep 2020 03:26:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-verify-that-new-datetime-xml-patch-was-applied-to-all-my/m-p/503063#M46146 arun_kant_sharm 2020-09-30T03:26:22Z