This page lists computing platforms, browsers, and features for which Splunk has deprecated or removed support.
What does "deprecated" mean?
Deprecated features and platforms continue to work and Splunk supports them until support is removed. However, customers should begin to plan now for the future removal of support.
What does "removed" mean?
When Splunk removes support for a feature, browser, or platform, it means that the feature, browser, or platform no longer works with the Splunk platform, and customers must find an alternative.
Splunk Enterprise platform support: Supported platforms for Splunk Enterprise will be identified as either Enterprise, Free/Trial, or Universal Forwarder.
- Enterprise: Full Splunk features and functions.
- Free/Trial: May be downloaded for demo and free use. May not support all features and functions.
- Universal Forwarder: Platforms that support the Splunk universal forwarder.
- Windows Server 2008 R2 x86_64: Enterprise, Free/Trial, and Universal Forwarder support is deprecated and might be removed entirely in a future release.
- Linux Kernel 2.6 x86-32: Universal Forwarder support is deprecated and might be removed entirely in a future release.
- AIX 6.1: Universal Forwarder support is deprecated and might be removed entirely in a future release.
- Solaris 11 x86_64: Enterprise and Free/Trial support is deprecated and might be removed entirely in a future release.
- Solaris 10 x86_64: Enterprise and Free/Trial support is deprecated and might be removed entirely in a future release.
- Windows 7 x86-32 & x86_64: Free/Trial and Universal Forwarder support has been removed.
- Mac OS X 10.9: Free/Trial and Universal Forwarder support has been removed.
- Linux Kernel 2.6 x86-32: Enterprise and Free/Trial support has been removed.
File systems removed
The following features have been deprecated or removed in Splunk Enterprise version 6.5:
The element-level refresh interval option <option name="refresh.auto.interval"> is deprecated. This is replaced with more robust refresh controls to set both the interval/delay as well as the display type.
In Web Framework, HeaderView and FooterView are deprecated and replaced with LayoutView.
Removed support for the <list> element. This element was deprecated in Splunk Enterprise 6.2.0 and is removed from the product in version 6.5.0. Use of this element in a dashboard now results in a validation error in edit mode, and is improperly renderered in view mode.
Previously deprecated features that still work
The following features have been deprecated in earlier versions of Splunk Enterprise but still work in version 6.5:
- Dashboard Framework
- Deprecated dual support for option height configuration as "100px" and "100"
- Deprecated the following attributes of <single>
- SplunkWeb Legacy Mode (setting appServerPorts = 0 in web.conf)
- Running Splunk Web in legacy mode (2 processes) is officially deprecated
- This was a temporary workaround for issues that are now resolved
- Normal mode provides performance and configuration benefits
- Advanced XML. For future development Splunk recommends that you use Simple XML.
- The Django Bindings feature of the Splunk Web Framework. For future development Splunk recommends that you use other features of the Splunk Web Framework, such as Simple XML extensions and HTML dashboards.
- Simple XML <seed> tag. In Simple XML <form> code blocks, use <initialValue> instead of <seed>.
- Simple XML <option name = "previewResults"> tag.
- "Run a Script" alert action. Use the custom alert action framework that was introduced in Splunk Enterprise 6.3.
- Simple XML charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag.
- Search Head Pooling over the Network File System (NFS) protocol. As an alternative, configure search head clustering.
- Simple XML row grouping. Row grouping has been replaced by the <panel> node in Simple XML.
- Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements. As of version 6.2 these elements are replaced by the new <search> element.
- Simple XML <earliestTime> and <latestTime> elements. As of version 6.2 these elements are replaced by <earliest> and <latest> elements.
- Simple XML <populatingSearch> and <populatingSavedSearch> elements. As of version 6.2 these elements are replaced by the new <search> element.
- Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field. As of version 6.1 these elements are replaced by the new <condition field="..."> element.
datamodel/accelerationRepresentational State Transfer (REST) endpoint has been deprecated and might be removed entirely in a future release.
- license_audit.log: Use license_usage.log instead.
SplunkLightForwarderapp. Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see "Deploy a light forwarder" in the Forwarding Data manual.
- Pre-trained CSV and IIS sourcetypes using the
CHECK_FOR_HEADERattribute. Use the
INDEXED_EXTRACTIONSand associated attributes instead.
- The ability to deploy in multi-tenant environments using
tenants.confon a deployment server.
- The capability for a deployment server to be a deployment client of itself has been disabled.
- The PDF Report Server app has been deprecated.
- FSchange monitor: Use
auditdand monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows.
- Saved searches used within event types: This feature is deprecated and might be removed in a future release.
- Event type auto-discovery: This feature is deprecated and might be removed in a future release.
CHECK_FOR_HEADERprops.conf attribute (for index-time field extractions): This feature is deprecated and might be removed in a future release.
entity.setEntityPython SDK function: This feature is deprecated and might be removed in a future release.
- Splunk modules: The following Splunk modules (elements of a view or dashboard) have been deprecated and might be removed in a future release:
Transparent huge memory pages and Splunk performance
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0