splunk datetime after January 2020

[snicol2017]

Hi,

I want to know, I do not actually update my datetime.xml and I want to know if I update now for the data.
Do I need to re-ingest, reindex or restore all my server to 31 december 2019 and reingest the data if I haved.

I still version 7.1.9, if I update to 7.3.4 do I still have problem with my data.

Thx

[richgalloway · Accepted solution]

You should examine your data for mis-dated events. Also, check splunkd.log for errors in processing timestamps. If your data does not contain two-digit years then you should see no problems and nothing will need to be re-ingested.

Updating Splunk will not affect your existing data. It will ensure you are able to ingest data with two-digit years in the timestamp.