Splunk Enterprise Security

Will an updated datetime.xml temporarily solve the Y2K timestamp issue?

Jarougeau
New Member

I have recently migrated to Splunk cloud and completed the necessary version upgrades to ensure we are compatible with the timestamp issue patching. However, I still have an on-prem instance of Splunk (that is still widely used by teams) that will be de-commissioned in the next few months (upon tying up loose ends with the cloud instance).

I am running version 6.6.3 on-prem. Rather than upgrade to a compatible version, can I simply update the version of datetime.xml and apply it to each on-prem Splunk server to solve the Y2K-timestamp issue?

Obviously, this would be a temporary solution - just long enough to allow me to complete the cloud migration and de-com the on-prem environment. Thanks!

0 Karma
1 Solution

zacharychristen
Path Finder

Yes, you can just download or manually update the file yourself. This will require a reboot. https://docs.splunk.com/Documentation/Splunk/6.6.3/ReleaseNotes/FixDatetimexml2020#Download_an_updat...

View solution in original post

0 Karma

zacharychristen
Path Finder

Yes, you can just download or manually update the file yourself. This will require a reboot. https://docs.splunk.com/Documentation/Splunk/6.6.3/ReleaseNotes/FixDatetimexml2020#Download_an_updat...

0 Karma

Jarougeau
New Member

Thank you. I have multiple servers in my Splunk environment, i.e., search heads, license master, cluster master, etc., do I need to update the datetime.xml in each of them, or just one specific?

0 Karma

gdaly_splunk
Splunk Employee
Splunk Employee

It requires a service restart not a reboot.

We will be releasing specific instruction videos on methods of the fix soon, including step-by-step instructions.

0 Karma

malmoore
Splunk Employee
Splunk Employee

Hi @Jarougeau,

You can use the app solution in the release note to deploy the apps to distributed environments. Review the README file that comes with the app archive download for specific instructions.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...