Getting Data In
Highlighted

Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

Explorer

We use Splunk Cloud and have 3 Heavy Forwarders (which I updated yesterday with the new datetime.xml). We also have about 10 universal fowarders (most of them on Windows). Do I need to apply the datetime.xml to those as well?

thanks!

0 Karma
Highlighted

Re: Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

SplunkTrust
SplunkTrust

There are a couple of conditions where updating datetime.xml on UFs is required:

  • When they have been configured to process structured data, such as CSV, XML, and JSON files, using the INDEXED_EXTRACTIONS setting in props.conf
  • When they have been configured to process data locally, using the forcelocalprocessing setting in props.conf

If these conditions don't apply, it's not a bad idea to update datetime.xml anyway.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Splunk datetime issue - does this affect Universal Forwarders forwarding to Splunk Cloud?

Explorer

Ok, thank you! I will go ahead and update them.

Thanks again!
Jon

0 Karma