Getting Data In

On which Splunk Enterprise servers FixDatetimexml2020 patch needs to be applied?



Query regarding Patch for "Timestamp recognition of dates with two-digit years fails beginning January 1, 2020" post.

On 25th Nov 2019, the post "" is asking to patch all Splunk instances instead of "Splunk Cloud, Splunk Enterprise indexer, Splunk Enterprise heavy forwarder, and Splunk Light instances" a day before.

Does this mean that on Splunk enterprise Clustered setup, this file must be patched on Cluster master, SH deployer, License Master, Indexers, Search-heads and all heavy & universal forwarder instances?
just indexers & heavy forwarder instances?

Also, on Splunk Enterprise All-in-one setups, this file must be patched. Correct?

Please clarify.

Thanks in advance,
Prashant Badhe

Tags (1)
0 Karma

The Docs keep on getting updated with the latest details. Refer to the Impact section for details:

| makeresults | eval message= "Happy Splunking!!!"


Also our team has tested various date formats and that get impacted after 2020 Jan. The utcepoch time only gets impacted after Sep 23. 2020 but it's better to fix all before Jan 1, 2020.

Here is the link :

0 Karma


You have to patch every instance that parses data that could contain such timestamps with two digit years or epoch format.

This definitely includes all indexers and HF. If you can be 100% sure that you will never ingest such logs on your SH, CM, DS, etc... you may be able to ignore them, but as some Linux logs on those boxes might be ingested now or in the future, I'd advise to patch them too. Maybe you can use the opportunity to update Splunk, too.

Be aware that you might even have to patch the UFs, if you use features like INDEXED_EXTRACTIONS or force_local_processing. An example of such a built-in sourcetype that would be affected is CSV.


If HF only use to receive and forward data to Indexer, HF can be to ignore?

0 Karma

@pbadhe_2 since this is related to timestamp recognition, I would say any instance that can index. Sometimes SHs can also index data which is forwarded to IDX cluster.

| makeresults | eval message= "Happy Splunking!!!"

Super Champion

On which Splunk version instances we need to apply this patch? is it only for 8.0?

0 Karma


Hi mayurr98,

see the docs to get a table of the Splunk versions.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...