Is there a way to check which hosts (universal forwarders or splunk enterprise) have the updated datetime.xml installed?
We have several different groups that send us logs from an internal network via a heavy forwarder, so I can see their splunkd logs, but there seems to be no record of the new file.
On the heavy installs, It reports properly.
On the universal forwarders, I was hoping that it would fail the file validation at startup and send the log to _internal, but even though "splunk.exe validate files" shows there is a change, nothing shows up in the splunkd log or at startup.
I am trying to generate a list of all hosts that do not have the file installed.
I realize that this timestamp issue may not affect certain log types, but we are not in a position to pick/choose which ones will work, so our strategy will be to apply the workaround to 100% of the instances.
Per Splunk support, the universal forwarders do not generate a usable message in their logs, although the heavy/full versions do.
It is possible to build a script that you can install as an app that will to a checksum check, but we are not in a position to install apps across devices we do not own.
So, manual checks it is.
Per Splunk support, the universal forwarders do not generate a usable message in their logs, although the heavy/full versions do.
It is possible to build a script that you can install as an app that will to a checksum check, but we are not in a position to install apps across devices we do not own.
So, manual checks it is.
Deployment server can produce a list of Splunk versions for UF/Splunk which can indicate that the endpoint being on a non patch UF.
Yes, but in our case, we only updated the XML.
Software updates would be better, but the release turnaround in our environment is prohibitively slow for an emergency like this.
Any suggestions here?
Having a hard time coming up with a verification method.