Splunk® Enterprise

Release Notes

This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Fixed issues

Splunk Enterprise 9.1.2 was released on November 16, 2023. This release includes fixes for the following issues. It also delivers relevant updates from the 2023-11-16 Security Advisories list.

Issues are listed in all relevant sections. Some issues might appear more than once.


Upgrade issues

Date resolved Issue number Description
2023-11-27 SPL-244559, SPL-245880, SPL-246158 Upgrades of Splunk Enterprise to version 9.1.x can fail on machines that run an operating system that does not use Unicode Transformation Format - 8 bit (UTF8) character set encoding.

Search issues

Date resolved Issue number Description
2024-03-28 SPL-253286 The limits.conf.spec file doesn't include the updated description for the 'read_final_results_from_timeliner' setting
2023-12-01 SPL-243932 Hybrid Search is failing with message "This search has encountered a fatal error and has been marked as zombied."
2023-09-28 SPL-245065, SPL-225303, SPL-245054 Segfault in BucketSummaryActorThread, originating in the lookup processor, causes crashing search processes for Data Model Accelerations
2023-09-21 SPL-244841, SPL-244119 Search processes segfault'ing due to Logger appender without layout definition

Federated search issues

Date resolved Issue number Description
2023-09-26 SPL-244937, SPL-238767 Standard mode federated search with longer than a minute From command searches, encounters socket ReadWrite error when the federated provider points to a cloud Load balancer, due to idle timeout on the LoadBalancer config
2023-09-15 SPL-243968, SPL-239689, SPL-244367 In transparent mode Federated Search for Splunk, custom search commands and the "outputlookup" command should run only on the local deployment. Instead they run on the remote deployment, leading to errors, incorrect results.
2023-08-18 SPL-243209, SPL-241502 Transparent federated search with service account making api calls takes excessive time

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2023-12-01 SPL-243932 Hybrid Search is failing with message "This search has encountered a fatal error and has been marked as zombied."
2023-11-16 SPL-246785, SPL-244383 Search-Scheduler Splunk Crashes on Job Servers in SHC.

Charting, reporting, and visualization issues

Date resolved Issue number Description
2023-07-20 SPL-242232 Dashboard Studio - CSV export does not wrap string values with quotes
2023-07-18 SPL-241761 Dashboard Studio - Table view export does not include all the data of the table in the CSV
2023-04-26 SPL-239070 SVGs in Dashboard Studio have white background instead of transparent in dark mode

Universal forwarder issues

Date resolved Issue number Description
2023-11-03 SPL-245807, SPL-246456, SPL-246545, SPL-246546 Splunk AIX UF crashing when failed to connect to indexers
2023-10-24 SPL-244414 Crashing in TcpOutEloop thread after upgrade from 9.1.x

Monitoring Console issues

Date resolved Issue number Description
2023-09-21 SPL-244916, SPL-243155 The Monitoring Console does not show Indexer and Search Head statistics on the Overview page.

Splunk Web and interface issues

Date resolved Issue number Description
2023-09-25 SPL-244178, SPL-240690 Requests for ui-tour and ui-pref endpoints are frequently taking seconds to complete.
Last modified on 28 March, 2024
Field alias behavior change   Deprecated and removed in version 9.1

This documentation applies to the following versions of Splunk® Enterprise: 9.1.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters