Getting Data In

splunk datetime after January 2020

snicol2017
New Member

Hi,

I want to know, I do not actually update my datetime.xml and I want to know if I update now for the data.
Do I need to re-ingest, reindex or restore all my server to 31 december 2019 and reingest the data if I haved.

I still version 7.1.9, if I update to 7.3.4 do I still have problem with my data.

Thx

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You should examine your data for mis-dated events. Also, check splunkd.log for errors in processing timestamps. If your data does not contain two-digit years then you should see no problems and nothing will need to be re-ingested.

Updating Splunk will not affect your existing data. It will ensure you are able to ingest data with two-digit years in the timestamp.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You should examine your data for mis-dated events. Also, check splunkd.log for errors in processing timestamps. If your data does not contain two-digit years then you should see no problems and nothing will need to be re-ingested.

Updating Splunk will not affect your existing data. It will ensure you are able to ingest data with two-digit years in the timestamp.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...