We use Splunk Cloud and have 3 Heavy Forwarders (which I updated yesterday with the new datetime.xml). We also have about 10 universal fowarders (most of them on Windows). Do I need to apply the datetime.xml to those as well?
There are a couple of conditions where updating datetime.xml on UFs is required:
If these conditions don't apply, it's not a bad idea to update datetime.xml anyway.
Ok, thank you! I will go ahead and update them.