Skip to content

Commit d97fb66

Browse files
Update README.md
1 parent 7b15587 commit d97fb66

File tree

1 file changed

+26
-1
lines changed

1 file changed

+26
-1
lines changed

README.md

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,23 @@ interval = -1
7373
source = ds_remove_output
7474
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dsRemove.ps1"
7575
76+
### Scripts used to correct issues with datetime.xml
77+
### https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
78+
[script://./bin/dateTimeCorrect.sh]
79+
disabled = 1
80+
index = _internal
81+
sourcetype = datetime_correct:output
82+
interval = -1
83+
source = datetime_correct_output
84+
85+
[powershell://dateTimeCorrect]
86+
disabled = 1
87+
index = _internal
88+
sourcetype = datetime_correct:output
89+
interval = -1
90+
source = datetime_correct_output
91+
script = . "$SplunkHome\etc\apps\SplunkForwarderRepairKit\bin\dateTimeCorrect.ps1"
92+
7693
### Admin password change scripts
7794
[script://./bin/pwchange.sh]
7895
disabled = 1
@@ -119,6 +136,14 @@ This app contains scripts for Windows and Linux forwarders that will move the ex
119136
Windows - `regenGUID.ps1`\
120137
\*Nix - `regenGUID.sh`
121138

139+
###### Install updated datetime.xml file
140+
A notice was sent out in November of 2019 that stated there was an issue with the datetime.xml that would affect data ingested due to a misconfigured datetime.xml. The bug and fix can be read about here: https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/FixDatetimexml2020
141+
142+
This app contains scripts for Windows and Linux forwarders that will back up the existing "datetime.xml" to replace with the corrected version contained within the app.
143+
144+
Windows - `dateTimeCorrect.ps1`\
145+
\*Nix - `dateTimeCorrect.sh`
146+
122147
###### Update default 'changeme' password on Splunk Forwarders (primary installations before 7.1.0)
123148
Forwarders deployed before version 7.1.0 didn't require the admin password be changed upon installation. Starting at 7.1.0, the forwarders required either a user-seed file or manual input of the password during first-time run. While the REST API of the forwarder is not configured to allow POST requests until the password is changed on versions prior to 7.1.0, changing the password is still recommended.
124149

@@ -131,4 +156,4 @@ Windows - `pwchange.bat`\
131156
Because most of these use-cases require the forwarders be restarted, an additional script has been introduced that takes the outcome of each of the scripts used and determines if a restart is required. Each script is designed to create an empty file that the restart script uses to determine if a restart is necessary. If the restart script finds one of the files used to trigger a restart, it removes them and should keep the system clean of unnecessary files.
132157

133158
Windows - `restart.ps1`\
134-
\*Nix - `restart.sh`
159+
\*Nix - `restart.sh`

0 commit comments

Comments
 (0)