4.1.1
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
4.1.1
The following issues have been resolved in this release:
- File upload fails with an error when
js_logger_mode=Serverinweb.conf. (SPL-29570) - The crawl command returns binary files when it shouldn't. (SPL-30522)
- A crawl input won't pickup directories with capital letters in the name. (SPL-30214)
- Forwarding data to an index that does not exist on the indexer will drop the data. (SPL-30366)
- Show source option is unavailable when using pipe to fields. (SPL-30290)
- Migration failed on LDAP config with same base DN's and improper group settings. (SPL-30784) Workaround is update groupMappingAttribute and groupMemberAttribute to a value that will be present in the user's ldif entry (e.g. uid)
- LDAP implementations where groupMappingAttribute is assigned multiple values will not work. Splunk requires that groupMappingAttribute have a unique value (SPL-30789)
- Drill-down does not work as expected with real-time search; will give zero results when expecting historical results. (SPL-29436)
- "Encountered an unexpected error while parsing intentions" error is generated when drilling down after using
| where. (SPL-30277) - CTRL/Command click isn't working for row clicks. (SPL-28530)
- Sometimes the header will contain the wrong event count from a previous search instead of the event count of the currently running search. (SPL-30338)
- Deleting a saved search job does not delete the associated dispatch directory. (SPL-30511)
- Jobs deleted from the Jobs Manager do not actually reclaim disk space. (SPL-30097)
- Scheduling a search doesn't validate that an email address has been entered when you click "Send email". (SPL-30392)
- PDF report of a scheduled search sometimes renders with a black bar on the timeline. (SPL-30393)
- Simple XML searchPostProcess doesn't work with <chart> and <fields>. (SPL-27248)
- Line wrapping is broken in the simple XML form. (SPL-29666)
- Entering incorrect credentials in the Windows GUI installer produces a self-contradictory error message. (SPL-29931)
- Creating a WMI collection with a name that includes trailing nulls generates an error. (SPL-29150)
- Windows Event Log (.evt) files are not indexed before they are deleted when they are dropped into the spool directory. (SPL-30355)
- Deleting via the CLI across a distributed deployment does not work unless the can_delete capability is assigned to the user's role on the indexer itself. (SPL-30498)
- Searching across a distributed system should not wait so long to decide one of the indexers is out of service before returning results. (SPL-30533)
- Splunk may crash when suspending in Mac OSX. (SPL-30308)
- Splunk now enforces a freespace check for the $SPLUNK_HOME/var/run/splunk/dispatch directory. This value is hardcoded to 2GB. Systems with less than 2 GB of freespace should symlink the directory to a partition with more space. (SPL-30788)
- Splunkd crash in typing thread. (SPL-30803, SPL-30786).
- indexprocessor not initialized on startup. (SPL-30782)
- Limit number of buckets moved at once in-flights in BucketMover. (SPL-30671)
- Add a raw kb field for tcpin_connection in metrics.log. (SPL-30844)
- EntityLinkLister does not ever pass on its value when clicked on. (SPL-30841)
- Lookups descriptions are not internationalized. (SPL-30813)
- splunkd crash at HTTPRequestHandlerThread. (SPL-30810)
- No timestamps on flashtime when using IE8. (SPL-30808)
- Show source doesn't work on Windows7. (SPL-30807)
- Field Extraction Wizard in Splunk Web doesn't not work. (SPL-30798)
- Need migration message when using lookup defined in some other app. (SPL-30796)
- Running a report in flashtimeline, using a selected range on the timeline, certain interactions from there discard the timeline selection. (SPL-30794)
- NOT searches on lookup generated fields fails to yield expected results. (SPL-30776)
- splunk-optimize failed to start for index, need a better error message. (SPL-30769)
- PDF Server add-on does not work if supportSSLV3Only = true in web.conf. (SPL-30764)
- Saved searches created in 4.0.x with latest time +0s display in UI as "custom relative time range". (SPL-30690)
- Creating saved search through Manager creates nonsense cron_schedule value. (SPL-30681)
- Inexplicable (and apparently benign) SSL_write errors in the logs. (SPL-30606)
- Shutdown on idle receiver takes minutes. (SPL-30575)
- Make disk quota checking faster. (SPL-30513)
- Summary popups in FieldPicker open offscreen and cant be closed. (SPL-30072)
- CLI login command on Win-32 build has been fixed. (SPL-30830)
This documentation applies to the following versions of Splunk: 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.