Hi,
I want to know, I do not actually update my datetime.xml and I want to know if I update now for the data.
Do I need to re-ingest, reindex or restore all my server to 31 december 2019 and reingest the data if I haved.
I still version 7.1.9, if I update to 7.3.4 do I still have problem with my data.
Thx
You should examine your data for mis-dated events. Also, check splunkd.log for errors in processing timestamps. If your data does not contain two-digit years then you should see no problems and nothing will need to be re-ingested.
Updating Splunk will not affect your existing data. It will ensure you are able to ingest data with two-digit years in the timestamp.
You should examine your data for mis-dated events. Also, check splunkd.log for errors in processing timestamps. If your data does not contain two-digit years then you should see no problems and nothing will need to be re-ingested.
Updating Splunk will not affect your existing data. It will ensure you are able to ingest data with two-digit years in the timestamp.