Skip to content

Commit 7b15587

Browse files
codingWithJimmycodingWithJimmy
committed
datetime.xml correction added
Added scripts used to correct the issue with datetime.xml being incorrect
1 parent db3aaa4 commit 7b15587

File tree

6 files changed

+286
-2
lines changed

6 files changed

+286
-2
lines changed

‎bin/dateTimeCorrect.ps1

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
### Capture current values for forwarder and configure file path variables for the system
2+
$existingDateTime = "$SPLUNKHOME\etc\datetime.xml"
3+
$referenceDateTime = "$SPLUNKHOME\apps\SplunkForwarderRepairKit\datetime.xml"
4+
$restartDateTimeCheck = "$SPLUNKHOME\etc\restartdatetime.txt"
5+
6+
### Filter to attach timestamps where necessary
7+
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
8+
9+
### Check flags and take appropriate actions for host name
10+
if(Compare-Object -ReferenceObject $(Get-Content $existingDateTime) -DifferenceObject $(Get-Content $referenceDateTime)) {
11+
Write-output "The datetime.xml file needs to be updated. Updating..." | timestamp
12+
Copy-Item -Path "$existingDateTime" -Destination "$existingDateTime_$(Get-Date -Format 'MMddyyyy').bak"
13+
Copy-Item -Path "$referenceDateTime" -Destination "$existingDateTime"
14+
Out-File -FilePath "$restartDateTimeCheck"
15+
} else {
16+
Write-output "The datetime.xml is the updated version. No correction necessary..." | timestamp
17+
}

‎bin/dateTimeCorrect.sh

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
### Determine the difference in the reference datetime.xml in the app and the datetime.xml currently used by Splunk
3+
EXISTING_DATETIME="$SPLUNK_HOME/etc/datetime.xml"
4+
REFERENCE_DATETIME="$SPLUNK_HOME/etc/apps/SplunkForwarderRepairKit/datetime.xml"
5+
DATETIME_DIFFERENCE=$(diff $REFERENCE_DATETIME $EXISTING_DATETIME | wc -l)
6+
RESTART_DATETIME_CHECK="$SPLUNK_HOME/etc/restartdatetime.txt"
7+
8+
### Determine if a correction is necessary
9+
if [ $DATETIME_DIFFERENCE = 0 ]; then
10+
echo "$(date +"%Y-%m-%d %H:%M:%S.%3N") ${HOSTNAME}: The datetime.xml is the updated version. No correction necessary..."
11+
else
12+
echo "$(date +"%Y-%m-%d %H:%M:%S.%3N") ${HOSTNAME}: The datetime.xml file needs to be updated. Updating..."
13+
cp $EXISTING_DATETIME $EXISTING_DATETIME.$(date +"%m%d%Y")
14+
cp $REFERENCE_DATETIME $EXISTING_DATETIME
15+
touch $RESTART_DATETIME_CHECK
16+
fi

‎bin/restart.ps1

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,17 @@ $inputPath = "$SPLUNKHOME\etc\restartinput.txt"
33
$serverPath = "$SPLUNKHOME\etc\restartserver.txt"
44
$dsPath = "$SPLUNKHOME\etc\restartds.txt"
55
$guidPath = "$SPLUNKHOME\etc\restartguid.txt"
6+
$dateTimePath = "$SPLUNKHOME\etc\restartdatetime.txt"
67
$restartInput = {$(Test-Path "$SPLUNKHOME\etc\restartinput.txt" -PathType Leaf)}
78
$restartServer = {$(Test-Path "$SPLUNKHOME\etc\restartserver.txt" -PathType Leaf)}
89
$restartDS = {$(Test-Path "$SPLUNKHOME\etc\restartds.txt" -PathType Leaf)}
910
$restartGUID = {$(Test-Path "$SPLUNKHOME\etc\restartguid.txt" -PathType Leaf)}
11+
$restartDateTime = {$(Test-Path "$SPLUNKHOME\etc\restartdatetime.txt" -PathType Leaf)}
1012

1113
### Filter to attach timestamps where necessary
1214
filter timestamp {"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss.fff') ${env:COMPUTERNAME}: $_"}
1315

14-
if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True") {
16+
if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "True" -OR $restartGUID -eq "True" -OR $restartDateTime -eq "True") {
1517
Write-output "One or more settings has been changed." | timestamp
1618
Write-output "Restarting forwarder." | timestamp
1719
if ($restartInput -eq "True") {
@@ -26,6 +28,9 @@ if ($restartInput -eq "True" -OR $restartServer -eq "True" -OR $restartDS -eq "T
2628
if ($restartGUID -eq "True") {
2729
Delete-Item -path "$guidPath"
2830
}
31+
if ($restartDateTime -eq "True") {
32+
Delete-Item -path "$dateTimePath"
33+
}
2934
sleep 5
3035
$restart = "restart"
3136
& "$SPLUNKHOME\bin\splunk.exe" $restart

‎bin/restart.sh

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ RESTARTINPUT="$SPLUNK_HOME/etc/restartinput.txt"
44
RESTARTSERVER="$SPLUNK_HOME/etc/restartserver.txt"
55
RESTARTDS="$SPLUNK_HOME/etc/restartds.txt"
66
RESTARTGUID="$SPLUNK_HOME/etc/restartguid.txt"
7+
RESTARTDATETIME="$SPLUNK_HOME/etc/restartdatetime.txt"
78

89
### If any files exist, restart forwarder
9-
if [ -f $RESTARTINPUT ] | [ -f $RESTARTSERVER ] | [ -f $RESTARTDS ] | [ -f $RESTARTGUID ]; then
10+
if [ -f $RESTARTINPUT ] | [ -f $RESTARTSERVER ] | [ -f $RESTARTDS ] | [ -f $RESTARTGUID ] | [ -f $RESTARTDATETIME ]; then
1011
echo "$(date +"%Y-%m-%d %H:%M:%S.%3N") ${HOSTNAME}: One or more settings has been changed."
1112
echo "$(date +"%Y-%m-%d %H:%M:%S.%3N") ${HOSTNAME}: Restarting forwarder."
1213
if [ -f $RESTARTINPUT ]; then
@@ -21,6 +22,9 @@ if [ -f $RESTARTINPUT ] | [ -f $RESTARTSERVER ] | [ -f $RESTARTDS ] | [ -f $REST
2122
if [ -f $RESTARTGUID ]; then
2223
rm $RESTARTGUID
2324
fi
25+
if [ -f $RESTARTDATETIME ]; then
26+
rm $RESTARTDATETIME
27+
fi
2428
sleep 5
2529
$SPLUNK_HOME/bin/splunk restart
2630
else

‎datetime.xml

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
<!-- Version 4.0 -->
2+
3+
<!-- datetime.xml -->
4+
<!-- This file contains the general formulas for parsing date/time formats. -->
5+
6+
<datetime>
7+
8+
<define name="_year" extract="year">
9+
<text><![CDATA[(20\d\d|19\d\d|[9012]\d(?!\d))]]></text>
10+
</define>
11+
12+
<define name="_month" extract="month">
13+
<text><![CDATA[(0?[1-9]|1[012])(?!:)]]></text>
14+
</define>
15+
16+
<define name="_litmonth" extract="litmonth">
17+
<text><![CDATA[(?<![\d\w])(jan|\x{3127}\x{6708}|feb|\x{4E8C}\x{6708}|mar|\x{4E09}\x{6708}|apr|\x{56DB}\x{6708}|may|\x{4E94}\x{6708}|jun|\x{516D}\x{6708}|jul|\x{4E03}\x{6708}|aug|\x{516B}\x{6708}|sep|\x{4E5D}\x{6708}|oct|\x{5341}\x{6708}|nov|\x{5341}\x{3127}\x{6708}|dec|\x{5341}\x{4E8C}\x{6708})[a-z,\.;]*]]></text>
18+
</define>
19+
20+
<define name="_allmonth" extract="litmonth, month">
21+
<text><![CDATA[(?:]]></text>
22+
<use name="_litmonth"/>
23+
<text><![CDATA[|]]></text>
24+
<use name="_month"/>
25+
<text><![CDATA[)]]></text>
26+
</define>
27+
28+
<define name="_day" extract="day">
29+
<text><![CDATA[(0?[1-9]|[12]\d|3[01])]]></text>
30+
</define>
31+
32+
<define name="_usday" extract="day">
33+
<use name="_day"/>
34+
<text><![CDATA[(?:st|nd|rd|th|[,\.;])?]]></text>
35+
</define>
36+
37+
<define name="_hour" extract="hour">
38+
<text><![CDATA[([01]?[0-9]|[012][0-3])(?!\d)]]></text>
39+
</define>
40+
41+
<define name="_minute" extract="minute">
42+
<text><![CDATA[([0-6]\d)(?!\d)]]></text>
43+
</define>
44+
45+
<define name="_second" extract="second">
46+
<text><![CDATA[([0-6]\d)(?!\d)]]></text>
47+
</define>
48+
49+
<define name="_zone" extract="zone">
50+
<text><![CDATA[((?:(?:UT|UTC|GMT(?![+-])|CET|CEST|CETDST|MET|MEST|METDST|MEZ|MESZ|EET|EEST|EETDST|WET|WEST|WETDST|MSK|MSD|IST|JST|KST|HKT|AST|ADT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|CAST|CADT|EAST|EADT|WAST|WADT|Z)|(?:GMT)?[+-]\d\d?:?(?:\d\d)?)(?!\w))?]]></text>
51+
</define>
52+
53+
<define name="_ampm" extract="ampm">
54+
<text><![CDATA[([ap]m(?:[^A-Za-z0-9]|$)|[\x{4E0A}\x{4E0B}]\x{5348})?]]></text>
55+
</define>
56+
57+
<define name="_time" extract="hour, minute, second, subsecond, ampm, zone">
58+
<text><![CDATA[(?<!\d)]]></text>
59+
<use name="_hour"/>
60+
<text><![CDATA[:]]></text>
61+
<use name="_minute"/>
62+
<text><![CDATA[:]]></text>
63+
<use name="_second"/>
64+
<text><![CDATA[(?:(?: \d{4})?[:,\.](\d+))? {0,2}]]></text>
65+
<use name="_ampm"/>
66+
<text><![CDATA[ {0,2}]]></text>
67+
<use name="_zone"/>
68+
<text><![CDATA[(?!:\d)]]></text>
69+
</define>
70+
71+
<define name="_hmtime" extract="hour, minute, ampm">
72+
<text><![CDATA[(?<!\d)]]></text>
73+
<use name="_hour"/>
74+
<text><![CDATA[:]]></text>
75+
<use name="_minute"/>
76+
<text><![CDATA[(?: ([ap]m(?:[^A-Za-z0-9]|$)|[\x{4E0A}\x{4E0B}]\x{5348}))?(?!:[:\d])]]></text>
77+
</define>
78+
79+
80+
<define name="_dottime" extract="hour, minute, second, subsecond, zone">
81+
<text><![CDATA[(?<![\d\.])([01]\d|2[0-3])\.]]></text>
82+
<use name="_minute"/>
83+
<text><![CDATA[(?:\.?]]></text>
84+
<use name="_second"/>
85+
<text><![CDATA[(?:[:,]\d+)?(?:\.(\d\d\d\d+))?) {0,2}]]></text>
86+
<use name="_zone"/>
87+
<text><![CDATA[(?![0-9\.])]]></text>
88+
</define>
89+
90+
<define name="_combdatetime" extract="year, month, day, hour, minute, second, subsecond">
91+
<!-- ... 20060502-000002 GMT ... -->
92+
<text><![CDATA[(?<![\d\.])(20\d\d)(0\d|1[012])([012]\d|3[01])[.-]?([01]\d|2[0123])([0-6]\d)([0-6]\d)(?:\.?(\d+))?]]>\s*</text>
93+
<use name="_zone"/>
94+
</define>
95+
96+
<define name="_combdatetime2" extract="year, ignored_sep, month, day, hour, minute, second, zone">
97+
<!-- ... 2007-3-22 0:0:2 GMT ...' -->
98+
<!-- ... 2007/3/22 0:0:2 GMT ...' -->
99+
<text><![CDATA[(?<![\d\.])(20\d\d)([-/])([01]?\d)\2([012]?\d|3[01])\s+([012]?\d):([0-6]?\d):([0-6]?\d)]]>\s*</text>
100+
<use name="_zone"/>
101+
</define>
102+
103+
104+
105+
<define name="_usdate" extract="litmonth, month, ignored_sep, day, zone, ignored_sep2, year">
106+
<text><![CDATA[(?<!\w|\d[:\.\-])]]></text>
107+
<use name="_allmonth"/>
108+
<text><![CDATA[([/\- ]) {0,2}]]></text>
109+
<use name="_day"/>
110+
<text><![CDATA[(?!:) {0,2}(?:\d\d:\d\d:\d\d(?:[\.\,]\d+)? {0,2}]]></text>
111+
<use name="_zone"/>
112+
<text><![CDATA[)?((?:\3|,) {0,2}]]></text>
113+
<use name="_year"/>
114+
<text><![CDATA[)?(?!/|\w|\.\d)]]></text>
115+
</define>
116+
117+
<!-- Jan 21, 09. allows spaces with litmonth only -->
118+
<define name="_usdate1" extract="litmonth, ignored_sep, day, zone, ignored_sep2, year">
119+
<text><![CDATA[(?<!\w|\d[:\.\-])]]></text>
120+
<use name="_litmonth"/>
121+
<text><![CDATA[([/\- ]) {0,2}]]></text>
122+
<use name="_day"/>
123+
<text><![CDATA[(?!:) {0,2}(?:\d\d:\d\d:\d\d(?:[\.\,]\d+)? {0,2}]]></text>
124+
<use name="_zone"/>
125+
<text><![CDATA[)?((?:\2|,) {0,2}]]></text>
126+
<use name="_year"/>
127+
<text><![CDATA[)?(?!/|\w|\.\d)]]></text>
128+
</define>
129+
130+
<!-- 10/21/09. doesn't allow spaces (e.g. 10 21 09) with numeric month -->
131+
<define name="_usdate2" extract="month, ignored_sep, day, zone, ignored_sep2, year">
132+
<text><![CDATA[(?<!\w|\d[:\.\-])]]></text>
133+
<use name="_month"/>
134+
<text><![CDATA[([/\-])]]></text>
135+
<use name="_day"/>
136+
<text><![CDATA[(?!:)(?:\d\d:\d\d:\d\d(?:[\.\,]\d+)? {0,2}]]></text>
137+
<use name="_zone"/>
138+
<text><![CDATA[)?((?:\2)]]></text>
139+
<use name="_year"/>
140+
<text><![CDATA[)?(?!/|\w|\.\d)]]></text>
141+
</define>
142+
143+
144+
<define name="_isodate" extract="year, ignored_sep, litmonth, month, day">
145+
<text><![CDATA[(?<![\w\d])]]></text>
146+
<use name="_year"/>
147+
<text><![CDATA[([\./\- ])]]></text>
148+
<use name="_allmonth"/>
149+
<text><![CDATA[(?!\d)(?:[\./\- ] {0,2})?]]></text>
150+
<use name="_day"/>
151+
<text><![CDATA[(?!/)(?:(?=T)|(?!\w)(?!\.\d))]]></text>
152+
</define>
153+
154+
<!-- eurodate format. period/dot delim separated out to eurodate2 -->
155+
<define name="_eurodate1" extract="day, ignored_sep, litmonth, month, year">
156+
<text><![CDATA[(?<![\w\.])]]></text>
157+
<use name="_usday"/>
158+
<text><![CDATA[([\- /]) {0,2}]]></text>
159+
<use name="_allmonth"/>
160+
<text><![CDATA[\2 {0,2}]]></text>
161+
<use name="_year"/>
162+
<text><![CDATA[(?![\w\.])]]></text>
163+
</define>
164+
165+
<!-- just period/dot delimiter. do not allow any spaces after dots (e.g. "version 5.4. 10" -->
166+
<define name="_eurodate2" extract="day, litmonth, month, year">
167+
<text><![CDATA[(?<![\w\.])]]></text>
168+
<use name="_usday"/>
169+
<text><![CDATA[\.]]></text>
170+
<use name="_allmonth"/>
171+
<text><![CDATA[\.]]></text>
172+
<use name="_year"/>
173+
<text><![CDATA[(?![\w\.])]]></text>
174+
</define>
175+
176+
177+
<define name="_bareurlitdate" extract="day, litmonth, year">
178+
<text><![CDATA[(\d\d?)\|\|(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\|\|(20\d\d)]]></text>
179+
</define>
180+
181+
<define name="_orddate" extract="year, ord">
182+
<text><![CDATA[\s([01]\d)([0123]\d\d)\s]]></text>
183+
</define>
184+
185+
<!-- due to high number of false positive matches, this format is
186+
limited to special cases. either at the start of a line or in
187+
filename matches only, by prefixing with a "source::" -->
188+
189+
<!-- don't allow multiple spaces after mashed date. indicates number in column -->
190+
<define name="_masheddate" extract="year, month, day">
191+
<text><![CDATA[(?:^|source::).*?(?<!\d|\d\.|-)(?:20)?([9012]\d)(0\d|1[012])([012]\d|3[01])(?!\d|-| {2,})]]></text>
192+
</define>
193+
<define name="_masheddate2" extract="month, day, year">
194+
<text><![CDATA[(?:^|source::).*?(?<!\d|\d\.)(0\d|1[012])([012]\d|3[01])(?:20)?([9012]\d)(?!\d| {2,})]]></text>
195+
</define>
196+
197+
<define name="_utcepoch" extract="utcepoch, subsecond">
198+
<!-- update regex before '2023' -->
199+
<text><![CDATA[((?<=^|[\s#,"=\(\[\|\{])(?:1[0123456]|9)\d{8}|^@[\da-fA-F]{16,24})(?:\.?(\d{1,6}))?(?![\d\(])]]></text>
200+
</define>
201+
202+
<timePatterns>
203+
<use name="_time"/>
204+
<use name="_hmtime"/>
205+
<use name="_hmtime"/>
206+
<use name="_dottime"/>
207+
<use name="_combdatetime"/>
208+
<use name="_utcepoch"/>
209+
<use name="_combdatetime2"/>
210+
</timePatterns>
211+
<datePatterns>
212+
<use name="_usdate1"/>
213+
<use name="_usdate2"/>
214+
<use name="_isodate"/>
215+
<use name="_eurodate1"/>
216+
<use name="_eurodate2"/>
217+
<use name="_bareurlitdate"/>
218+
<use name="_orddate"/>
219+
<use name="_combdatetime"/>
220+
<use name="_masheddate"/>
221+
<use name="_masheddate2"/>
222+
<use name="_combdatetime2"/>
223+
</datePatterns>
224+
225+
</datetime>

‎default/inputs.conf

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,23 @@ interval = -1
6262
source = ds_remove_output
6363
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dsRemove.ps1"
6464

65+
### Scripts used to correct issues with datetime.xml
66+
### https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
67+
[script://./bin/dateTimeCorrect.sh]
68+
disabled = 1
69+
index = _internal
70+
sourcetype = datetime_correct:output
71+
interval = -1
72+
source = datetime_correct_output
73+
74+
[powershell://dateTimeCorrect]
75+
disabled = 1
76+
index = _internal
77+
sourcetype = datetime_correct:output
78+
interval = -1
79+
source = datetime_correct_output
80+
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dateTimeCorrect.ps1"
81+
6582
### Admin password change scripts
6683
[script://./bin/pwchange.sh]
6784
disabled = 1

0 commit comments

Comments
 (0)