Deprecated and removed in version 9.4

This page lists features, computing platforms, and browsers for which Splunk Inc. has deprecated or removed support in this version of the Splunk platform.

What does "deprecated" mean?

Deprecated features, platforms, and browsers continue to work and Splunk supports them until support is removed. However, customers need to begin planning now for the future removal of support.

What does "removed" mean?

When Splunk removes support for a feature, platform, or browser it means that the feature, platform, or browser no longer works with the Splunk platform and customers must find an alternative.

Deprecated features in version 9.4

The following table summarizes the features that are deprecated. These features continue to be supported, but Splunk reminds customers that deprecated features might be removed in a future release.

Newly deprecated in this version	What do I need to know?	First deprecated
Python 3.7 runtime	Splunk plans to remove the Python 3.7 runtime from Splunk Enterprise. We urge customers to upgrade their apps to use Python 3.9 as soon as possible. Most likely Splunk will remove the Python 3.7 runtime in the next non-maintenance release of Splunk Enterprise.	Version 9.4.0
Version 3.0 of the Secure Sockets Layer (SSL) and versions 1.0 and 1.1 of the transport layer security (TLS) network encryption protocols	SSL version 3.0 and TLS versions 1.0 and 1.1 are deprecated and might be removed in a future release. To connect Splunk components and services securely going forward, specify TLS version 1.2 or higher in configuration files for those components.	Version 9.4.0
Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards.	Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards is deprecated and will be removed in a future release.	Version 9.4.0
Still deprecated in this version	What do I need to know?	First deprecated
The spawn_process parameter	Do not use the Splunk platform REST API spawn_process parameter. It is deprecated and will be removed in a future release.	Version 9.3.0
Splunk platform search execution methods	The phased_execution_mode setting is deprecated and should not be included in limits.conf configuration files. If the phased_execution_mode setting is specified, Splunk software displays a warning message instructing users to contact their administrator to delete the setting from their limits.conf file.	Version 9.2.0
The populate_lookup alert action	The legacy alert action, populate_lookup, is deprecated and will be disabled in a future release. Use the lookup alert action instead. You can still attach a lookup alert action to new saved searches even though the populate_lookup alert action is deprecated.	Version 9.2.0
The /services/search/commands REST API endpoint.	The undocumented /services/search/commands REST API endpoint is deprecated and will be removed in a future release. If you have been inadvertently using this endpoint, stop using it.	Version 9.2.0
Versions 3.0 and lower of the Splunk-To-Splunk (S2S) Protocol	S2S V3 is deprecated and will be removed in a future release. S2S Protocol V3 is automatically upgraded to V4 by default, and a warning message is generated.	Version 9.0.0
The createrss command	The createrss command is deprecated and disabled by default.	Version 9.0.0
The _reload action with the rest search command	Use of the _reload action with the rest command is deprecated. Do not use the _reload action with the rest command.	Version 9.0.0
The $SPLUNK_HOME/bin/srm (secure remove file) binary executable file	This binary executable, which removes files securely using a number of algorithms, was added in the version 6.0 release so that Splunk Enterprise could comply with Common Criteria requirements. Current Common Criteria guidelines preclude the need for the file, thus it has been deprecated and will likely be removed in a future release.	Version 8.2.0
Support of HTML dashboards	Support of HTML dashboards has been deprecated. Use Dashboard Studio to rebuild and configure dashboards.	Version 8.2.0
The msearch command	The msearch command is replaced with the mpreview command.	Version 8.1.0
The tscollect command	The tscollect command relies on time-series index (tsidx) files in namespaces that reside on individual search heads and are incompatible with search head clustering. This feature has been superseded by data models, which reside on the indexer and are more performant. Data models are accessible from any search head. See Accelerate data models in the Knowledge Manager Manual.	Version 7.3.0
literals.conf	Use of literals.conf has been deprecated. Use messages.conf to modify notifications that display in Splunk Web.	Version 7.2.2
The static/app-packages endpoint	This endpoint has been deprecated and might be removed entirely in a future release.	Version 6.6.x.
Element-level refresh interval	The element-level refresh interval option <option name="refresh.auto.interval"> has been replaced with more robust refresh controls to set both the interval/delay as well as the display type.	Version 6.5.x
HeaderView and FooterView in the Splunk Web Framework	HeaderView and FooterView are replaced by LayoutView.	Version 6.5.x
Dashboard Framework: Dual support for option height configuration	Splunk has deprecated dual support for option height configuration as "100px" and "100".	Version 6.4.x
Dashboard Framework: Selected attributes of <single>	Splunk has deprecated the following attributes of <single>: additionalClass classField beforeLabel afterLabel linkFields linkSearch linkView	Version 6.4.x
Simple XML <seed> tag	In Simple XML <form></form> code blocks, use <initialValue> instead of <seed>.	Version 6.3.x
Simple XML <option name = "previewResults"> tag	This tag has been deprecated and might be removed entirely in a future release.	Version 6.3.x
"Run a Script" alert action	Use the custom alert action framework introduced in Splunk platform 6.3.	Version 6.3.x
Simple XML charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag	These attributes have been deprecated and might be removed entirely in a future release.	Version 6.3.x
Search Head Pooling over the Network File System (NFS) protocol	As an alternative, configure search head clustering.	Version 6.2.x
Simple XML row grouping	Row grouping is replaced by the <panel> node in Simple XML.	Version 6.2.x
Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements	These elements are replaced by the new <search> element.	Version 6.2.x
Simple XML <earliestTime> and <latestTime> elements	These elements are replaced by <earliest> and <latest> elements.	Version 6.2.x
Simple XML <populatingSearch> and <populatingSavedSearch> elements	These elements are replaced by the <search> element.	Version 6.2.x
Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field	These elements are replaced by the <condition field="..."> element.	Version 6.2.x
The datamodel/acceleration REST endpoint	This endpoint has been deprecated and might be removed entirely in a future release.	Version 6.1.x
license_audit.log	Use license_usage.log instead.	Version 6.0.x
The SplunkLightForwarder app	Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see Deploy a light forwarder in the Forwarding Data manual.	Version 6.0.x
Pre-trained CSV and IIS sourcetypes using the CHECK_FOR_HEADER attribute	Use the INDEXED_EXTRACTIONS and associated attributes instead.	Version 6.0.x
The ability to deploy in multi-tenant environments using tenants.conf on a deployment server	This feature has been deprecated and might be removed in a future release.	Version 6.0.x
The capability for a deployment server to be a deployment client of itself	This feature was disabled in version 6.0.x. It is deprecated and might be removed in a future release.	Version 6.0.x
FSchange monitor	Use auditd and monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows. See Monitor file system changes in Getting Data In.	Version 5.x
Saved searches used within event types	This feature has been deprecated and might be removed in a future release.	Version 5.x
Event type auto-discovery	This feature has been deprecated and might be removed in a future release.	Version 5.x
Distributed block signing and event hashing	This feature has been deprecated and might be removed in a future release.	Version 5.x
CHECK_FOR_HEADER props.conf attribute (for index-time field extractions)	This feature has been deprecated and might be removed in a future release.	Version 5.x
entity.setEntity Python SDK function	This feature has been deprecated and might be removed in a future release.	Version 5.x
The setfields command	The setfields command is deprecated.	Version 5.x
The folderize command	The folderize command is deprecated.	Version 4.2

Removed features in version 9.4

Splunk has removed the following features in version 9.4. Customers must immediately find alternatives.

Removed in this version	What do I need to know?	First deprecated
The Splunk Assist on-premises environment analysis service for Monitoring Console	Splunk ended activations for the Splunk Assist service, which monitored Splunk Enterprise environments for improvements on security, configuration, and application setup postures, on September 10, 2024. The service will stop functioning entirely on Splunk Enterprise deployments beginning January 30, 2025. Version 9.4.0 of Splunk Enterprise has these components removed. Learn more	Was not deprecated initially
Version 1 of the stats command	Version 1 of the stats command has been removed and replaced with version 2 of the stats command. If your limits.conf file includes use_stats_v2 = false or use_stats_v2 = fixed_width, remove these lines to clean up your limits.conf file. These settings have no effect because version 2 of the stats command is enabled by default.	Version 9.1.0
bin/jsmin executable	Executable was used for internal purposes and neither intended nor documented for customer use.

Platform support changes in version 9.4

The following tables summarize the deprecation and removal of support for specific operating systems and file systems in this version of Splunk Enterprise.

For complete information on supported platforms, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.

Deprecated operating systems in version 9.4

The following table summarizes the deprecated operating systems in this version of Splunk Enterprise. A blank cell or an unlisted operating system indicates there is no change to support in this version.

Operating system	Splunk Enterprise with an Enterprise license	Splunk Enterprise with a Free or Trial license	Universal forwarder
Ubuntu 20.04	Deprecated	Deprecated	Deprecated
Amazon Linux 2 (x86 64-bit)	Deprecated	Deprecated	Deprecated
Amazon Linux 2 ARM (64-bit)			Deprecated
raspi4 Ubuntu 20.04			Deprecated

Removed operating systems in version 9.4

None.

Deprecated CPU architectures

Splunk software requires a CPU processor that supports the x86-64-v2 (Intel/AMD) or NEON (ARM) architecture. Most modern processors manufactured after 2008 include this support. Support for the use of processors that do not meet this requirement is deprecated in Splunk Enterprise 9.3.

Support for the use of processors that do not meet this requirement will be removed in the next major or minor version of Splunk Enterprise after version 9.3.

This CPU requirement and the notice of deprecation does not apply to the Universal Forwarder package.

Deprecated file systems in version 9.4

None.

Removed file systems in version 9.4

None.

Browser support changes in version 9.4

The following sections summarize the deprecation and removal of support for specific browsers in this version of the Splunk platform.

Deprecated browser support in version 9.4

None.

Removed browser support in version 9.4

None.