UF and Platform version level compatibility with new timestamp issue

[jeffbat]

Just got the notification about the timestamp issue coming in Jan 2020.

Timestamp Issue

I am currently running 7.2.4.2 across my Indexers/Search Heads/Heavy Forwarders. I see that I can just change out the datetime.xml file on them to resolve the issue.

My main question is around the Universal Forwarder level, with my backend being 7.2.4; can I upgrade my forwarders to 7.2.9.1 and there be no issue? We are running a mixture of 6.6.3 and 7.2.4.2 forwarders now. I will be difficult for us to put in a change for our backend infrastructure of Splunk to 7.2.9.1 so changing the file out makes sense but we likely can get the forwarders set to be upgraded if there will not be any compatibility issues with it talking to a lower minor version.

thanks for any information.

[satyenshah · Accepted solution]

Yes, version 7.2.9.1 forwarders are compatible with 7.2.4 indexers:
https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

We have a mix of UF versions ranging from 7.0 to 8.0.0, alongside indexers that have been are frequently updated, and have never run into an indexer-compatibility issue.

At the same time, you can get away without doing anything to the UFs, since the timestamp extraction / cooking of data happens downstream of the UF.

[lmichalski_2]

1. Could you add -f flag for copy inside scripts? Actually copying did not work for me, because original datetime.xml can have permissions=444. Without flag -f cp can return Permission denied. Or another way - chmod temporarily /opt/splunkforwarder/etc/datetime.xml to 644

I don't know yet if similar thing is needed for Windows UF
2. According to this https://stackoverflow.com/a/38285462 , could you add permissions for executing?

[satyenshah]

I fatfingered cp -rp by habit. Changed to cp -f. Thanks for the heads up!

[jeffbat]

That is what I thought, thanks.