Splunk® Enterprise

Release Notes

Download manual as PDF

Deprecated features

This page lists computing platforms, browsers, and features for which Splunk has deprecated or removed support.

What does "deprecated" mean?

Deprecated features and platforms continue to work and Splunk supports them through the 6.3.x lifecycle. However, customers should begin planning now for the future removal of these features from the supported set of products.

What does "removed" mean?

When Splunk removes support for a feature, browser, or platform, it means that the feature, browser, or platform no longer works with Splunk Enterprise, and customers must find an alternative.

Platform support

  • Splunk Enterprise platform support: Supported platforms for Splunk Enterprise will be identified as either Enterprise, Free/Trial, or Universal Forwarder.
    • Enterprise: Full Splunk features and functions.
    • Free/Trial: May be downloaded for demo and free use. May not support all features and functions.
    • Universal Forwarder: Platforms that support the Splunk universal forwarder.

Deprecated platforms

  • Windows Server 2008 x86 & x86_64: Enterprise, Free/Trial, and Universal Forwarder support for Windows Server 2008 x86 & x86_64 has been deprecated and might be removed entirely in a future release.
  • FreeBSD 8.x x86: Universal Forwarder support for FreeBSD 8.x x86 has been deprecated, and might be removed entirely in a future release.
  • Linux Kernel 2.6 x86-32: Enterprise and Free/Trial support for Linux Kernel 2.6 x86-32 has been deprecated and might be removed entirely in a future release. Universal Forwarder packages remain generally available.
  • HP-UX 11i v2 for Itanium-64: Universal Forwarder support for HP-UX 11i v2 for Itanium-64 has been deprecated and might be removed entirely in a future release.

Removed platforms

  • Windows 8 x86_64: Enterprise support for Windows 8 x86_64 has been removed. Free/Trial and Universal Forwarder packages remain generally available.
  • Windows 7 x86_64: Enterprise support for Windows 7 x86_64 has been removed. Free/Trial and Universal Forwarder packages remain generally available.
  • Windows Server 2003 x86 & x86_64: All support for Windows Server 2003 x86 & x86_64 has been removed.
  • FreeBSD 9.x x86_64: Enterprise and Free/Trial support for FreeBSD 9.x x86_64 has been removed. Universal Forwarder packages remain generally available.
  • FreeBSD 8.x x86_64: All support for FreeBSD 8.x x86_64 has been removed.
  • FreeBSD 7.x x86: Universal Forwarder support for FreeBSD 7.x has been removed.
  • Mac OS X 10.8: All support for Mac OS X 10.8 has been removed.
  • Solaris 10 x86-32: Universal Forwarder support for Solaris 10 x86-32 has been removed.
  • Solaris 10 and 11 SPARC: Enterprise and Free/Trial support for Solaris 10 and 11 SPARC has been removed. Universal Forwarder packages remain generally available.
  • AIX 6.1 and 7.1: Enterprise and Free/Trial support for AIX 6.1 and 7.1 has been removed. Universal Forwarder packages remain generally available.

File systems removed

  • Reiser3. All support for the Reiser3 file system has been removed.

Browser support

Browsers deprecated

  • Internet Explorer version 9. Support for this browser has been deprecated and will be removed entirely in a future release. Also, Microsoft has declared that it will no longer support browsers earlier than Internet Explorer version 11 after January 12, 2016. See "Internet Explorer End of Support" on the Microsoft website.

Browsers removed

  • None.

Feature support

The following features have been deprecated or removed in Splunk Enterprise version 6.3:

Deprecated features

  • Advanced XML. Apps and dashboards that use Advanced XML continue to work. However, for future development Splunk recommends that you use Simple XML.
  • The Django Bindings feature of the Splunk Web Framework. Apps and dashboards that use Django Bindings will continue to work. However, for future development Splunk recommends that you use other features of the Splunk Web Framework, such as Simple XML extensions and HTML dashboards.
  • The Simple XML <seed> tag. In Simple XML <form> code blocks, use <initialValue instead of <seed>. For compatibility, Simple XML still respects the <seed> tag, but Splunk no longer documents this tag.
  • The Simple XML <option name = "previewResults"> tag. The searchTemplate tag supported this tag, but has also been deprecated.
  • The "Run a Script" alert action. The alert action is still available, but might be removed in a future release. Use the custom alert action framework that was introduced in Splunk Enterprise 6.3.
  • The charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag in Simple XML. These attributes might be removed in a future release.

Removed features

App support

Support for the Splunk Deployment Monitor App has been removed. In Splunk Enterprise 6.3 and later, the Distributed Management Console (DMC) feature replaces the functionality of the Splunk Deployment Monitor App.

Previously deprecated features that still work

The following features have been deprecated in earlier versions of Splunk Enterprise but still work in version 6.3:

6.2.x:

  • Search Head Pooling over the Network File System (NFS) protocol. As an alternative, configure search head clustering.
  • Simple XML dashboard, "list" visualization type.
  • Simple XML row grouping. Row grouping has been replaced by the <panel> node in Simple XML.
  • Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements. As of version 6.2 these elements are replaced by the new <search> element.
  • Simple XML <earliestTime> and <latestTime> elements. As of version 6.2 these elements are replaced by <earliest> and <latest> elements.
  • Simple XML <populatingSearch> and <populatingSavedSearch> elements. As of version 6.2 these elements are replaced by the new <search> element.
  • Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field. As of version 6.1 these elements are replaced by the new <condition field="..."> element.

6.1.x:

  • The datamodel/acceleration Representational State Transfer (REST) endpoint has been deprecated and might be removed entirely in a future release.
  • Support for indexing data on HP_UX has been deprecated and might be removed entirely in a future release.

6.0.x:

  • license_audit.log: Use license_usage.log instead.
  • The SplunkLightForwarder app. Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see "Deploy a light forwarder" in the Forwarding Data manual.
  • Pre-trained CSV and IIS sourcetypes using the CHECK_FOR_HEADER attribute. Use the INDEXED_EXTRACTIONS and associated attributes instead.
  • The crawl search command.
  • The ability to deploy in multi-tenant environments using tenants.conf on a deployment server.
  • The capability for a deployment server to be a deployment client of itself has been disabled.
  • The PDF Report Server app has been deprecated.

5.x:

  • FSchange monitor: Use auditd and monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows.
  • Saved searches used within event types: This feature is deprecated and might be removed in a future release.
  • Event type auto-discovery: This feature is deprecated and might be removed in a future release.
  • Round-robin load balancing: This feature was deprecated in Splunk 4.2. Automatic load balancing is now the default.
  • Distributed block signing and event hashing: This feature is deprecated and might be removed in a future release.
  • CHECK_FOR_HEADER props.conf attribute (for index-time field extractions): This feature is deprecated and might be removed in a future release.
  • entity.setEntity Python SDK function: This feature is deprecated and might be removed in a future release.
  • Splunk modules: The following Splunk modules (elements of a view or dashboard) have been deprecated and might be removed in a future release:
    • AdvanceModeToggle
    • AjaxInclude
    • AsciiTimeline
    • CakeBrushFormatter
    • ConvertToRedirect
    • DistributedSearchServerChooser
    • HiddenIntention
    • IndexesSizes
    • MultiplexSparkline
    • PostProcessBar
    • SavedSearches
    • Segmentation
    • SimpleEventsView
PREVIOUS
6.3.1
  NEXT
Credits

This documentation applies to the following versions of Splunk: 6.3.0, 6.3.1, 6.3.2, 6.3.3 View the Article History for its revisions.


Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole
Feedback you enter here will be delivered to the documentation team

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters