The sha256sum of the patched datetime.xml file is this: [root@ip-10-202-22-128 all_date_patch_props]# sha256sum datetime.xml e6016245a677bff48ea7ddbe8d4b36f9acbd02918e1f90ead812892692d655ea datetime.xml So I create a simple bash script (let's call it datetime_check.sh): sha256sum $SPLUNK_HOME/etc/datetime.xml sha256sum $SPLUNK_HOME/etc/apps/all_date_patch_props/datetime.xml sha256sum $SPLUNK_HOME/etc/slave_apps/idxc_date_patch_props/local/datetime.xml This checks the three main locations that it might be (assuming the default app names) and generates the sum. Then, make an inputs.conf: [script://$SPLUNK_HOME/etc/apps/search/bin/datetime_check.sh] disabled = false index = main interval = 3600 source = datetime_check sourcetype = datetime_check Then you can simply search for all the sums and use stats to track deployment progress. ... View more

When DB Connect was untarred, a chmod command was run against it. Unfortunately, this ended up removing executable permissions from the bash script inside the app that starts the task server. Removed the app, untarred it again and ran chown instead, set the Java path and restarted Splunk, and then it worked. ... View more

Upon reviewing configs, there were stanzas in ..etc/search/local/props.conf and ..etc/system/local/props.conf like this: [host::t*] FIELDALIAS-t*_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype [host::pcf] FIELDALIAS-pcf_Stacktrace_as_StackTrace = Stacktrace AS StackTrace FIELDALIAS-pcf_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype [host::*] FIELDALIAS-allhost_sourcedFrom_as_sourcetype = sourcedFrom AS sourcetype sourcedfrom AS sourcetype Field aliasing has been changed in 7.2 and these entries broke sourcetypes on the production search head. Once they were removed, and the search head was restarted, the problem was fixed. ... View more