The following are issues and workarounds for this version of Splunk Enterprise.
Refer to System requirements in the Installation Manual for a list of supported platforms and architectures.
For a list of deprecated features and platforms, refer to Deprecated features in this manual.
|Date filed||Issue number||Description|
|2017-05-09||SPL-141693||DataModel Editor - when child object has same name as inherited field, inherited field does not show in the inherited fields list.|
|2017-02-27||SPL-137673, SPL-138970, SPL-138969||When running Health check on 6.5.2 Some linux items check on window some are skipped|
|2017-01-06||SPL-134707||Splunk restart does not create missing server.pem certificate on Windows|
Use Template:Bin/splunk createssl server-cert -d etc/auth/ -n server to generate a new certificate.
|2016-08-31||SPL-127800||opting in to data sharing on a monitoring console produces duplicate data|
|2016-07-26||SPL-125052||Sole Admin can demote his/herself to Power without path of recovery in GUI|
Through the command line, you can open notepad and modify the password file to regain 'Admin' status.
|2016-07-11||SPL-124026, SPL-122942||Relative paths should not be allowed under volume's path=file:// on remote storages|
|2015-11-13||SPL-109427||LDAP SSL no longer working in Splunk 6.3 (and later) for Windows 2003|
The workaround is to
1) obtain Ciphers configured on Windows AD 2003 server.
2) tweak TLS_CIPHER_SUITE command in etc/openldap/ldap.conf to match it.
The following is a working TLS_CIPHER_SUITE for one of the customers:
|2015-10-07||SPL-107606||Inconsistency between summary and datamodel_summary files.|
|2015-06-10||SPL-103010||Indexing throughput on a forwarder with four pipelinesets drops 30% compared to a forwarder with two pipelinesets.|
|2015-02-26||SPL-97389||When using timechart command, the embedded report shows different time format than the original report.|
|2015-01-08||SPL-95144, SPL-142789, SPL-101986, SPL-101987, SPL-106884, SPL-107317||Indexed message for Windows security event logs shows "FormatMessage error"|
Splunk believes this was introduced in a Microsoft Windows patch. The workaround is to configure a delayed start of the Splunk service(s) so that it starts after the Windows Event Log service.
|2014-10-31||SPL-92596||After upgrade from Splunk Enterprise 6.1 or earlier to 6.4.x on Windows, splunkweb service does not start automatically. Attempts to start it manually show "Error 1053: The service did not respond to the start or control request in a timely fashion."|
This is expected behavior. See the Splunk Answers post: http://answers.splunk.com/answers/177187/why-is-the-splunk-web-service-not-running-after-an.html
|2014-09-11||SPL-90738||Monitoring a directory with an unknown sourcetype produces indexing errors.|
|2014-08-26||SPL-90139||<timestamp> does not display in the Patterns tab when searches are run in fast mode.|
|2014-04-01||SPL-82517||Paper Size and Layout in PDF Schedule dialog do not respect Paper Size and Layout in Email Settings.|
|2014-03-23||SPL-82238||Datamodel fails to drill down further when the same attribute for Split Rows and Split Columns are selected.|
|2014-03-13||SPL-81856||Show all lines does not work in data model editor preview.|
|2014-03-12||SPL-81781||In the Data Model Manager, "Acceleration Status" and "Access Count" fail to update when you click "Update".|
|2014-02-07||SPL-80285||In the Data Model Editor, the Edit Lookup page is blank if Lookup is shared only in Lookup Definitions.|
For more information, see Add lookup files to Splunk.
|2014-02-06||SPL-80187||In the Data Model Editor, lookup pages open with options displayed for other Lookup when the data model definition is private but the file is app or globally shared.|
Share the definition. For more information, see Add lookup files to Splunk.
|2013-09-13||SPL-74337, BETA-496||You cannot specify a destination folder when installing on OSX.|
|2013-04-30||SPL-66213||PDF server app is not working with latest Xvfb|
|2012-02-22||SPL-48342||LDAP strategy host field cannot work with ipv6 format address but computer name is okay|
Splunk Analytics for Hadoop
|Date filed||Issue number||Description|
|2017-04-04||ERP-2040||Splunk archiving fails for large block sizes (buckets) due to HDFS write crashes.|
|2015-09-09||ERP-1650||timestamp data type not properly deserialized.|
|2015-08-05||ERP-1619||Searching on a newly created archive index before the bucket copy saved search is run causes a filenotfound exception.|
Reenable the bucket copy saved search and let it run, or force the archiving to happen via | archivebuckets force=1 and then rerun the search.
|2015-07-07||ERP-1598||minsplit rampup - splits generation takes too long.|
|2015-05-12||ERP-1502||Non-accelerated pivot search on Pivot UI page waits for a long time to return result.|
|2015-01-08||ERP-1343, SPL-95174||Splunk Analytics for Hadoop searches fail on corrupted journal.gz files, although Splunk searches run without error.|
Add the journal.gz to the input path's blacklist (vix.input.1.ignore = ....)
|2014-10-27||ERP-1216||Data Explorer preview does not honor existing sourcetypes for big5/sjis files.|
|2014-10-03||ERP-1164||Report acceleration summary gets deleted when two Splunk Analytics for Hadoop instances point to the same Splunk working directory|
To mitigate this issue, make sure that vix.splunk.home.hdfs (or Working directory in the UI) is unique on both search heads that are not in a pool. To keep your instances in the same working directory, configure vix.splunk.search.cache.path to be unique on both search heads.
Welcome to Splunk Enterprise 6.6
Splunk Enterprise and anti-virus products
This documentation applies to the following versions of Splunk® Enterprise: 6.6.2