Getting Data In

/etc/datetime.xml priority timestamp patch / configuration file precedence

realsplunk
Motivator

Hello,

regarding https://docs.splunk.com/Documentation/Splunk/8.2.2/ReleaseNotes/FixDatetimexml2020 - in case we upgrade Splunk version does /etc/datetime.xml is still less priority than pushed patch app on shc/idxc/UFs ?

Looking at https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Wheretofindtheconfigurationfiles I may understand /etc is lowest priority?

How do you handle it if you keep V7 universal forwarders and upgrade servers to 8.2.2 version?

Thanks.

0 Karma
1 Solution

realsplunk
Motivator

Support : "the new version of Splunk includes the new parameters, so the workaround are not longer needed if your indexers and HF are running Splunk 8.X, and as I told you before, only the Indexers and HF can do parsing, so that also means that the parameter is not needed in the Universal Forwarders."

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you are running a version of Splunk with the patch then there is no need to update datetime.xml.

The /etc directory is not part of the configuration file precedence order.  $SPLUNK_HOME/etc/system/default is the lowest-priority directory.

Just do it, but bear in mind the 7.x UFs will be unsupported soon.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

realsplunk
Motivator

Hi Rich,

 Looks like datetime.xml in 8.2.2 is different than in patch.

V4 xml:
<define name="_utcepoch" extract="utcepoch, subsecond">
<!-- update regex before '2023' -->
<text><![CDATA[((?<=^|[\s#,"=\(\[\|\{])(?:1[0123456]|9)\d{8}|^@[\da-fA-F]{16,24})(?:\.?(\d{1,6}))?(?![\d\(])]]></text>
</define>

V5 xml:
<define name="_utcepoch" extract="utcepoch, subsecond">
<!-- update regex before '2030' -->
<text><![CDATA[((?<=^|[\s#,"=\(\[\|\{])(?:1[012345678])\d{8}|^@[\da-fA-F]{16,24})(?:\.?(\d{1,6}))?(?![\d\(])]]></text>
</define>

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the newer one.

---
If this reply helps you, an upvote would be appreciated.

realsplunk
Motivator

Support : "the new version of Splunk includes the new parameters, so the workaround are not longer needed if your indexers and HF are running Splunk 8.X, and as I told you before, only the Indexers and HF can do parsing, so that also means that the parameter is not needed in the Universal Forwarders."

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...