Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

[jgaccornero]

We use Splunk Cloud and have 3 Heavy Forwarders (which I updated yesterday with the new datetime.xml). We also have about 10 universal fowarders (most of them on Windows). Do I need to apply the datetime.xml to those as well?

thanks!

[richgalloway]

There are a couple of conditions where updating datetime.xml on UFs is required:

• When they have been configured to process structured data, such as CSV, XML, and JSON files, using the INDEXED_EXTRACTIONS setting in props.conf
• When they have been configured to process data locally, using the force_local_processing setting in props.conf

If these conditions don't apply, it's not a bad idea to update datetime.xml anyway.

[jgaccornero]

Ok, thank you! I will go ahead and update them.

Thanks again!
Jon