Splunk® Enterprise

Release Notes

Download manual as PDF

Deprecated features

This page lists computing platforms, browsers, and features for which Splunk has deprecated or removed support.

What does "deprecated" mean?

Deprecated features and platforms continue to work and Splunk supports them until support is removed. However, customers should begin to plan now for the future removal support.

What does "removed" mean?

When Splunk removes support for a feature, browser, or platform, it means that the feature, browser, or platform no longer works with the Splunk platform, and customers must find an alternative.

Platform support

Splunk Enterprise platform support: Supported platforms for Splunk Enterprise will be identified as either Enterprise, Free/Trial, or Universal Forwarder.

  • Enterprise: Full Splunk features and functions.
  • Free/Trial: May be downloaded for demo and free use. May not support all features and functions.
  • Universal Forwarder: Platforms that support the Splunk universal forwarder.

Deprecated platforms

  • Windows 7 x86-32 & x86_64: Free/Trial and Universal Forwarder support has been deprecated and might be removed entirely in a future release.
  • Windows Server 2008 R2 x86_64: Enterprise, Free/Trial, and Universal Forwarder support has been deprecated and might be removed entirely in a future release.
  • Mac OS X 10.9: Free/Trial and Universal Forwarder support has been deprecated and might be removed entirely in a future release.
  • Linux Kernel 2.6 x86-32: Universal Forwarder support has been deprecated and might be removed entirely in a future release.

Removed platforms

  • Windows Server 2008 x86-32 & x86_64: Enterprise, Free/Trial, and Universal Forwarder support for Windows Server 2008 x86 & x86_64 has been removed.
  • FreeBSD 8 x86-32: Universal Forwarder support for Free BSD 8 x86 has been removed.
  • Linux Kernel 2.6 x86-32: Enterprise and Free/Trial support for Linux Kernel 2.6 x86-32 has been removed.
  • HP-UX 11i v2 for Itanium-64: Universal Forwarder support for HP-UX 11i v2 for Itanium-64 has been removed.

File systems removed

None.

Browser support

Browsers deprecated

None.

Browsers removed

Internet Explorer versions 9 and 10. Support for these versions of the Internet Explorer browser have been removed. Also, Microsoft has declared that it will no longer support browsers earlier than Internet Explorer version 11 after January 12, 2016. See "Internet Explorer End of Support" on the Microsoft website.

Feature support

The following features have been deprecated or removed in Splunk Enterprise version 6.4:

Deprecated features

  • Dashboard Framework
    • Deprecated dual support for option height configuration as "100px" and "100"
    • Deprecated the following attributes of <single>
      • additionalClass
      • classField
      • beforeLabel
      • afterLabel
      • linkFields
      • linkSearch
      • linkView
  • SplunkWeb Legacy Mode (setting appServerPorts = 0 in web.conf)
    • Running Splunk Web in legacy mode (2 processes) is officially deprecated
    • This was a temporary workaround for issues that are now resolved
    • Normal mode provides performance and configuration benefits

Removed features

  • Dashboard Framework
    • Removed support for simple_xml_module_renderer=true in web.conf
    • Removed support for simple_xml_force_flash_charting=true in web.conf
    • Removed support for (?showsource=advanced) URL request
    • Removed support for d3chartview
    • Removed support for googlemapsview
  • System Activity view
    • The information shown in the System Activity view in earlier versions of Splunk Enterprise is now included in Distributed Management Console views. The System Activity view is removed from this version of Splunk Enterprise. For more information, see the Distributed Management Console Manual.

Previously deprecated features that still work

The following features have been deprecated in earlier versions of Splunk Enterprise but still work in version 6.4:

6.3.x:

  • Advanced XML. For future development Splunk recommends that you use Simple XML.
  • The Django Bindings feature of the Splunk Web Framework. For future development Splunk recommends that you use other features of the Splunk Web Framework, such as Simple XML extensions and HTML dashboards.
  • Simple XML <seed> tag. In Simple XML <form> code blocks, use <initialValue> instead of <seed>.
  • Simple XML <option name = "previewResults"> tag.
  • "Run a Script" alert action. Use the custom alert action framework that was introduced in Splunk Enterprise 6.3.
  • Simple XML charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag.

6.2.x:

  • Search Head Pooling over the Network File System (NFS) protocol. As an alternative, configure search head clustering.
  • Simple XML dashboard, "list" visualization type.
  • Simple XML row grouping. Row grouping has been replaced by the <panel> node in Simple XML.
  • Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements. As of version 6.2 these elements are replaced by the new <search> element.
  • Simple XML <earliestTime> and <latestTime> elements. As of version 6.2 these elements are replaced by <earliest> and <latest> elements.
  • Simple XML <populatingSearch> and <populatingSavedSearch> elements. As of version 6.2 these elements are replaced by the new <search> element.
  • Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field. As of version 6.1 these elements are replaced by the new <condition field="..."> element.

6.1.x:

  • The datamodel/acceleration Representational State Transfer (REST) endpoint has been deprecated and might be removed entirely in a future release.

6.0.x:

  • license_audit.log: Use license_usage.log instead.
  • The SplunkLightForwarder app. Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see "Deploy a light forwarder" in the Forwarding Data manual.
  • Pre-trained CSV and IIS sourcetypes using the CHECK_FOR_HEADER attribute. Use the INDEXED_EXTRACTIONS and associated attributes instead.
  • The crawl search command.
  • The ability to deploy in multi-tenant environments using tenants.conf on a deployment server.
  • The capability for a deployment server to be a deployment client of itself has been disabled.
  • The PDF Report Server app has been deprecated.

5.x:

  • FSchange monitor: Use auditd and monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows.
  • Saved searches used within event types: This feature is deprecated and might be removed in a future release.
  • Event type auto-discovery: This feature is deprecated and might be removed in a future release.
  • CHECK_FOR_HEADER props.conf attribute (for index-time field extractions): This feature is deprecated and might be removed in a future release.
  • entity.setEntity Python SDK function: This feature is deprecated and might be removed in a future release.
  • Splunk modules: The following Splunk modules (elements of a view or dashboard) have been deprecated and might be removed in a future release:
    • AdvanceModeToggle
    • AjaxInclude
    • AsciiTimeline
    • CakeBrushFormatter
    • ConvertToRedirect
    • DistributedSearchServerChooser
    • HiddenIntention
    • IndexesSizes
    • MultiplexSparkline
    • PostProcessBar
    • SavedSearches
    • Segmentation
    • SimpleEventsView
PREVIOUS
Transparent huge memory pages and Splunk performance
  NEXT
Credits

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0 View the Article History for its revisions.


Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole
Feedback you enter here will be delivered to the documentation team

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters