Not an answer to the question, but I have built our own image of the forwarder which is patched against this bug. This is the Dockerfile I used:
FROM splunk/universalforwarder:7.x.x
LABEL maintainer="your@email.here"
COPY datetime.xml /var/opt/splunk/etc/datetime.xml
... View more