Splunk Enterprise

How do we test the upgrade for the 2020 datetime issue?

danielbb
Motivator

Based on Which forwarder version sloves the timestamp recognition of dates with two-digit years fails beginni...

We went ahead and upgraded to 7.3.3. How do we verify that we are ready for 2020?

Tags (1)

niketn
Legend

@danielbb create a temporary index and feed test data with events having yy-mm-dd and other two digit formats like dd-mm-yy etc which you want to test. Also set MAX_DAYS_HENCE to allow future date events to be indexed. If the data is getting inserted correctly then it proves the fix works.

Refer to Splunk Documentation for validation steps: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020#Validate_timesta...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

danielbb
Motivator

You know, when running - ./splunk btool props list --debug | grep MAX_DAYS_HENCE it gives me $SPLUNK_HOME/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 1547 times. Why so many?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...