Splunk Search

Splunk platform release notes

akarivaratharaj
Communicator

I was going through the Release note which was updated into Splunk Docs recently.
https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020?elqTrackId=29cfe...

It is mentioned that

Beginning on January 1, 2020, un-patched Splunk platform instances will be unable to recognize timestamps from events where the date contains a two-digit year. This means data that meets this criteria will be indexed with incorrect timestamps.

My Splunk version of Splunk Enterprise is 7.0.2, I have checked the format of timestamp from some of the sample events which are indexing into my Splunk instances. The timestamp format of the events which are forwarded to Splunk is correct with four-digit of year. But only my Splunk is showing the timestamp of logged events in two-digit of year. Please refer the highlighted part in the screenshot Splunk_events_timestamp

Is the existing timestamp format with the events are right or should I need to modify anything to accommodate with the changes effective on January 1st 2020?

0 Karma

broberg
Communicator

Problem as i got it is from a regex in the file on the splunk installation so splunk will not be able to read timestamps with a 20 instead of 19 in the start.

They do not have 2020 in the regex but only 2010-2019 (simplified)
Meaning that we need to update that file datetime.xml on all hosts that process data with timestamps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...