The leap second will not have any impact on Splunk services, such as causing service outages.

However, Splunk does not recognize leap seconds in timestamps. If a timestamp is a leap second, there are two possible effects:

Timestamps may not be recognized and events may end up on multiple lines.

Timestamps are recognized with different values than the actual timestamps.

About events that span multiple lines

By default, Splunk uses the timestamp as the event separator.
If multiple lines are set as one event, there is no effect because the delimiter is explicitly specified.

If data is output with one event per line, ^unless "SHOULD_LINEMERGE=false" is explicitly defined in props.conf for the source type of the target data import settings, the timestamp may not be recognized and the event may end up on multiple lines.

*The setting "SHOULD_LINEMERGE=false" is for importing one event per line. The default value is "true", and the setting BREAK_ONLY_BEFORE_DATE is also set to "true", so events are separated before the timestamp. If the timestamp cannot be recognized, a line is determined by the regular expression defined in the setting LINE_BREAKER. The default value of LINE_BREAKER is ([\r\n]+).

When perceived timestamps differ from reality

If a timestamp with "60" displayed, such as 8:59:60 seconds (leap second), is output to the logs or data that Splunk is ingesting, the following actions will be taken. After that, steps 1 to 4 will be applied and processed in that order.

• If Splunk does not recognize the timestamp (date + time) of an event, it will recognize it as the most recent event from the same source with the same timestamp.
  For example, if there is an event 59 seconds before 8:59:60 on July 1, 2015, the timestamp of 60 seconds cannot be recognized and it will be recognized as the event immediately preceding it, 8:59:59 on July 1, 2015.
• If the log files to be ingested by Splunk Enterprise contain only the time of the event (no date information), the date information is applied from the file name or source name of the log file.
• If the above 2. does not apply, Splunk will use the file modification date when ingesting events.
• If none of the above options are available, Splunk will use the system time at the time the event was captured.