datetime.xml 2020

[riqbal47010]

I am implemented the datetime.xml issue. Now according to article
https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
I want to validate the change.

I create test.csv file as metioned in above link. now how can I upload and validate in my distributed environment.

[kamlesh_vaghela · Accepted solution]

@riqbal47010

have you check this?

https://www.youtube.com/watch?v=tIcRvw2zx34

Check step 5 in https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020#Validate_timestam...

Using the Splunk CLI, add the text file you saved earlier as a oneshot monitor to the Splunk platform instance that you want to validate.

$SPLUNK_HOME/bin/splunk add oneshot -source test_file.csv -sourcetype csv -index main

[riqbal47010]

I gone through all the steps but I have distributed environment.
below are performed steps.

following step#3
On Heavy forwarder I create props.conf file under $SPLUNK_HOME/etc/system/local
[default]
MAX_DAYS_HENCE = 40

after that I add file through step#5

but results are not as expected.

the events time is the time when I am uploading the events.

[kamlesh_vaghela]

Did you executed step 4??

Just for troubleshooting, is it possible to keep local copy in the HF and execute step 5 again. And just check data on HF only.

I found steps For distributed environment please check below link.

https://blog.zivaro.com/splunk-product-timestamp-issue-solution

[riqbal47010]

hi kamlesh,

thanks fory your kind support.

I check the video link and found that to see the future date I have to select all times

thanks for your support