Adarma Advisory: Splunk Timestamp Recognition
Channel: Harry McLaren
Date: 2019-12-09

TL:DR — There’s a significant configuration issue within almost all Splunk software regarding two-digit year timestamps that requires urgent remediation. Logs ingested on or after 01/01/20 may not be ingested correctly. Update your software or implement a short-term fixed datetime.xml file immediately.
Tech Blog posting on this issue: https://medium.com/adarma-tech-blog/splunk-timestamp-issue-4ba1087735c7