Getting Data In

Reporting clients with the timestamp workaround (datetime.xml file) in place

oliverj
Communicator

Is there a way to check which hosts (universal forwarders or splunk enterprise) have the updated datetime.xml installed?
We have several different groups that send us logs from an internal network via a heavy forwarder, so I can see their splunkd logs, but there seems to be no record of the new file.
On the heavy installs, It reports properly.
On the universal forwarders, I was hoping that it would fail the file validation at startup and send the log to _internal, but even though "splunk.exe validate files" shows there is a change, nothing shows up in the splunkd log or at startup.

I am trying to generate a list of all hosts that do not have the file installed.

I realize that this timestamp issue may not affect certain log types, but we are not in a position to pick/choose which ones will work, so our strategy will be to apply the workaround to 100% of the instances.

0 Karma
1 Solution

oliverj
Communicator

Per Splunk support, the universal forwarders do not generate a usable message in their logs, although the heavy/full versions do.
It is possible to build a script that you can install as an app that will to a checksum check, but we are not in a position to install apps across devices we do not own.
So, manual checks it is.

View solution in original post

0 Karma

oliverj
Communicator

Per Splunk support, the universal forwarders do not generate a usable message in their logs, although the heavy/full versions do.
It is possible to build a script that you can install as an app that will to a checksum check, but we are not in a position to install apps across devices we do not own.
So, manual checks it is.

View solution in original post

0 Karma

ycefalas
Loves-to-Learn

Deployment server can produce a list of Splunk versions for UF/Splunk which can indicate that the endpoint being on a non patch UF.

0 Karma

oliverj
Communicator

Yes, but in our case, we only updated the XML.
Software updates would be better, but the release turnaround in our environment is prohibitively slow for an emergency like this.

0 Karma

oliverj
Communicator

Any suggestions here?
Having a hard time coming up with a verification method.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!