How do we test the upgrade for the 2020 datetime issue?


Based on Which forwarder version sloves the timestamp recognition of dates with two-digit years fails beginni...

We went ahead and upgraded to 7.3.3. How do we verify that we are ready for 2020?

Tags (1)


@danielbb create a temporary index and feed test data with events having yy-mm-dd and other two digit formats like dd-mm-yy etc which you want to test. Also set MAX_DAYS_HENCE to allow future date events to be indexed. If the data is getting inserted correctly then it proves the fix works.

Refer to Splunk Documentation for validation steps:

| makeresults | eval message= "Happy Splunking!!!"


You know, when running - ./splunk btool props list --debug | grep MAX_DAYS_HENCE it gives me $SPLUNK_HOME/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 1547 times. Why so many?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!