Splunk® Data Stream Processor

Release Notes

Acrobat logo Download manual as PDF


On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see the Upgrade the Splunk Data Stream Processor topic.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Known issues for DSP

This version of the Splunk Data Stream Processor has the following known issues and workarounds.

If no issues appear here, no issues have yet been reported.

Highlighted issues

Date filed Issue number Description
2020-09-18 DSP-26954 Activated pipelines cannot be reactivated after upgrading.

Workaround:
Reactivate your pipelines with "Skip Restore State" enabled. Since "Skip Restore State" discards the saved state of your pipeline, your pipeline ignores any data ingested while it is deactivated causing data loss.

Uncategorized issues

Date filed Issue number Description
2021-12-03 DSP-43606 Server can be attacked by slow clients during TLS handshake
2021-06-01 DSP-38591 Subseconds are not sent to Firehose
2021-05-26 DSP-38420 While upgrading to DSP 1.2.4, some pods failed to deploy properly resulting in a "The /app/dsp phase ("Update application \"dsp\" to 1.2.3) has failed Job was active longer than specified deadline" error.

Workaround:
This issue happens when Minio or Zookeeper pods are not able to come up because they could not mount the persistant volumes. To remedy this issue, follow the steps below:

1. Delete the affected MinIO or Zookeeper pods


2. Delete the persistent volume claim (PVC) of the affected pods


3. Delete the persistent volume (PV) of the affected pod

2021-05-19 DSP-38173 While upgrading to DSP 1.2.4, the upgrade fails with a "rpc error: code = Unknown desc = exit status 255" error.

Workaround:
1. Check which phase of the upgrade you are in by running the following command from $DSP_HOME/gravity: ./gravity plan.

2. Set the last phase to completed: ./gravity plan set —phase=/gc/<name-of-phase> —state completed . For example, ./gravity plan set --phase=/gc/mng-stg5-ingest-dsp-test-multizone-worker-fgf9 --state completed

3. Resume the installation: ./gravity plan resume.

2021-05-18 DSP-38061 While upgrading to DSP 1.2.4, the upgrade gets stuck at "[<step_number>/<total_step_number>] Phase /gc/<node>"

Workaround:
Force a retry of the upgrade by doing the following steps from $DSP_HOME/gravity:

1. ./gravity rollback —phase=/gc/<node>


2. ./gravity execute —phase=/gc/<node>


3. ./gravity plan resume

2021-05-17 DSP-37986 While upgrading to DSP 1.2.4, the upgrade fails due to a "Shutting down the agents: context deadline exceeded" error.

Workaround:
Roll back every phase of the upgrade and perform the upgrade again.

1. Check which phases of the upgrade were already completed from $DSP_HOME/gravity: 
./gravity plan


2. Roll back every completed phase: 
./gravity rollback —phase=/checks
 , ./gravity rollback —phase=/init
 , ./gravity plan complete

2020-10-07 DSP-27878 Apply Line Break function metrics show twice the number of records.
2020-10-05 DSP-27716 Large batch size when using a clustered KV Store behind a GCP load balancer causes HTTPs requests to exceed allowed size (status code 431).

Workaround:
Reduce the batch size limit to make the request under 16KB.
2020-09-30 DSP-27483 On macOS, you cannot accept the warning for the self-signed TLS certificate

Workaround:
Type "thisisunsafe" in the browser window to accept the certificate.
2020-09-18 DSP-26912 Generated SPL can erroneously duplicate statement names when statement names of the form statement_n are hard-coded in the Pipeline JSON.

Workaround:
Change the hard-coded statement names in the Pipeline JSON to something that does not match statement_n.
2020-09-10 DSP-26551 DSP installation pre-flight check for disk space should check the correct volume/directory.

Workaround:
/var/data is always erroneously checked for disk size, even if another volume is specified with --location. You can symlink where you intend to install to /var/data as a workaround.

For example, if you use --location /data, first ln -s /data /var/data

2020-08-31 DSP-26064 Upgrading DSP gives a "HTTPS Status 500 - Internal Server Error" on initial login.

Workaround:
Clear your browser cache and then try logging back into DSP.
2020-08-17 DSP-25339 DSP does not run on an operating system that has FIPS mode enabled.
2020-04-21 DSP-20380 When toggling between the Canvas Builder and SPL2 Builder, function configurations are unexpectedly populated with default values.

Workaround:
Configure every function so the UPL is valid.
2020-04-08 DSP-19759 DSP does not properly ingest sourcetypes with INDEXED_EXTRACTIONS=true.
Last modified on 18 March, 2022
PREVIOUS
New features for DSP 		  NEXT
Fixed Issues for DSP

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.4

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters