Splunk® Enterprise

Release Notes

Download manual as PDF

Download topic as PDF

Deprecated features

This page lists computing platforms, browsers, and features for which Splunk has deprecated or removed support.

What does "deprecated" mean?

Deprecated features and platforms continue to work and Splunk supports them until support is removed. However, customers should begin to plan now for the future removal of support.

What does "removed" mean?

When Splunk removes support for a feature, browser, or platform, it means that the feature, browser, or platform no longer works with the Splunk platform, and customers must find an alternative.

Platform support

Splunk Enterprise platform support: Supported platforms for Splunk Enterprise will be identified as either Enterprise, Free/Trial, or Universal Forwarder.

  • Enterprise: Full Splunk features and functions.
  • Free/Trial: May be downloaded for demo and free use. May not support all features and functions.
  • Universal Forwarder: Platforms that support the Splunk universal forwarder.

Deprecated platforms

  • Windows Server 2008 R2 x86_64: Enterprise, Free/Trial, and Universal Forwarder support is deprecated and might be removed entirely in a future release.
  • Linux Kernel 2.6 x86-32: Universal Forwarder support is deprecated and might be removed entirely in a future release.
  • AIX 6.1: Universal Forwarder support is deprecated and might be removed entirely in a future release.
  • Solaris 11 x86_64: Enterprise and Free/Trial support is deprecated and might be removed entirely in a future release.
  • Solaris 10 x86_64: Enterprise and Free/Trial support is deprecated and might be removed entirely in a future release.

Removed platforms

  • Windows 7 x86-32 & x86_64: Free/Trial and Universal Forwarder support has been removed.
  • Mac OS X 10.9: Free/Trial and Universal Forwarder support has been removed.
  • Linux Kernel 2.6 x86-32: Enterprise and Free/Trial support has been removed.

File systems removed

None.

Browser support

Browsers deprecated

None.

Browsers removed

None.

Feature support

The following features have been deprecated or removed in Splunk Enterprise version 6.5:

Deprecated features

The element-level refresh interval option <option name="refresh.auto.interval"> is deprecated. This is replaced with more robust refresh controls to set both the interval/delay as well as the display type.

In Web Framework, HeaderView and FooterView are deprecated and replaced with LayoutView.

Removed features

Removed support for the <list> element. This element was deprecated in Splunk Enterprise 6.2.0 and is removed from the product in version 6.5.0. Use of this element in a dashboard now results in a validation error in edit mode, and is improperly renderered in view mode.

Previously deprecated features that still work

The following features have been deprecated in earlier versions of Splunk Enterprise but still work in version 6.5:

6.4.x:

  • Dashboard Framework
    • Deprecated dual support for option height configuration as "100px" and "100"
    • Deprecated the following attributes of <single>
      • additionalClass
      • classField
      • beforeLabel
      • afterLabel
      • linkFields
      • linkSearch
      • linkView
  • SplunkWeb Legacy Mode (setting appServerPorts = 0 in web.conf)
    • Running Splunk Web in legacy mode (2 processes) is officially deprecated
    • This was a temporary workaround for issues that are now resolved
    • Normal mode provides performance and configuration benefits

6.3.x:

  • Advanced XML. For future development Splunk recommends that you use Simple XML.
  • The Django Bindings feature of the Splunk Web Framework. For future development Splunk recommends that you use other features of the Splunk Web Framework, such as Simple XML extensions and HTML dashboards.
  • Simple XML <seed> tag. In Simple XML <form> code blocks, use <initialValue> instead of <seed>.
  • Simple XML <option name = "previewResults"> tag.
  • "Run a Script" alert action. Use the custom alert action framework that was introduced in Splunk Enterprise 6.3.
  • Simple XML charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag.

6.2.x:

  • Search Head Pooling over the Network File System (NFS) protocol. As an alternative, configure search head clustering.
  • Simple XML row grouping. Row grouping has been replaced by the <panel> node in Simple XML.
  • Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements. As of version 6.2 these elements are replaced by the new <search> element.
  • Simple XML <earliestTime> and <latestTime> elements. As of version 6.2 these elements are replaced by <earliest> and <latest> elements.
  • Simple XML <populatingSearch> and <populatingSavedSearch> elements. As of version 6.2 these elements are replaced by the new <search> element.
  • Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field. As of version 6.1 these elements are replaced by the new <condition field="..."> element.

6.1.x:

  • The datamodel/acceleration Representational State Transfer (REST) endpoint has been deprecated and might be removed entirely in a future release.

6.0.x:

  • license_audit.log: Use license_usage.log instead.
  • The SplunkLightForwarder app. Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see "Deploy a light forwarder" in the Forwarding Data manual.
  • Pre-trained CSV and IIS sourcetypes using the CHECK_FOR_HEADER attribute. Use the INDEXED_EXTRACTIONS and associated attributes instead.
  • The crawl search command.
  • The ability to deploy in multi-tenant environments using tenants.conf on a deployment server.
  • The capability for a deployment server to be a deployment client of itself has been disabled.
  • The PDF Report Server app has been deprecated.

5.x:

  • FSchange monitor: Use auditd and monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows.
  • Saved searches used within event types: This feature is deprecated and might be removed in a future release.
  • Event type auto-discovery: This feature is deprecated and might be removed in a future release.
  • CHECK_FOR_HEADER props.conf attribute (for index-time field extractions): This feature is deprecated and might be removed in a future release.
  • entity.setEntity Python SDK function: This feature is deprecated and might be removed in a future release.
  • Splunk modules: The following Splunk modules (elements of a view or dashboard) have been deprecated and might be removed in a future release:
    • AdvanceModeToggle
    • AjaxInclude
    • AsciiTimeline
    • CakeBrushFormatter
    • ConvertToRedirect
    • DistributedSearchServerChooser
    • HiddenIntention
    • IndexesSizes
    • MultiplexSparkline
    • PostProcessBar
    • SavedSearches
    • Segmentation
    • SimpleEventsView
PREVIOUS
6.5.0
  NEXT
Credits

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters