Reporting clients with the timestamp workaround (datetime.xml file) in place

[oliverj]

Is there a way to check which hosts (universal forwarders or splunk enterprise) have the updated datetime.xml installed?
We have several different groups that send us logs from an internal network via a heavy forwarder, so I can see their splunkd logs, but there seems to be no record of the new file.
On the heavy installs, It reports properly.
On the universal forwarders, I was hoping that it would fail the file validation at startup and send the log to _internal, but even though "splunk.exe validate files" shows there is a change, nothing shows up in the splunkd log or at startup.

I am trying to generate a list of all hosts that do not have the file installed.

I realize that this timestamp issue may not affect certain log types, but we are not in a position to pick/choose which ones will work, so our strategy will be to apply the workaround to 100% of the instances.

[oliverj · Accepted solution]

Per Splunk support, the universal forwarders do not generate a usable message in their logs, although the heavy/full versions do.
It is possible to build a script that you can install as an app that will to a checksum check, but we are not in a position to install apps across devices we do not own.
So, manual checks it is.

[ycefalas]

Deployment server can produce a list of Splunk versions for UF/Splunk which can indicate that the endpoint being on a non patch UF.

[oliverj]

Yes, but in our case, we only updated the XML.
Software updates would be better, but the release turnaround in our environment is prohibitively slow for an emergency like this.

[oliverj]

Any suggestions here?
Having a hard time coming up with a verification method.