I am implemented the datetime.xml issue. Now according to article
https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
I want to validate the change.
I create test.csv file as metioned in above link. now how can I upload and validate in my distributed environment.
@riqbal47010
have you check this?
https://www.youtube.com/watch?v=tIcRvw2zx34
Check step 5 in https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020#Validate_timestam...
Using the Splunk CLI, add the text file you saved earlier as a oneshot monitor to the Splunk platform instance that you want to validate.
$SPLUNK_HOME/bin/splunk add oneshot -source test_file.csv -sourcetype csv -index main
@riqbal47010
have you check this?
https://www.youtube.com/watch?v=tIcRvw2zx34
Check step 5 in https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020#Validate_timestam...
Using the Splunk CLI, add the text file you saved earlier as a oneshot monitor to the Splunk platform instance that you want to validate.
$SPLUNK_HOME/bin/splunk add oneshot -source test_file.csv -sourcetype csv -index main
I gone through all the steps but I have distributed environment.
below are performed steps.
following step#3
On Heavy forwarder I create props.conf file under $SPLUNK_HOME/etc/system/local
[default]
MAX_DAYS_HENCE = 40
after that I add file through step#5
but results are not as expected.
the events time is the time when I am uploading the events.
Did you executed step 4??
Just for troubleshooting, is it possible to keep local copy in the HF and execute step 5 again. And just check data on HF only.
I found steps For distributed environment please check below link.
https://blog.zivaro.com/splunk-product-timestamp-issue-solution
hi kamlesh,
thanks fory your kind support.
I check the video link and found that to see the future date I have to select all times
thanks for your support