Known and fixed issues for

This page lists selected known issues and fixed issues for this release of . Use the Version drop-down list to see known issues and fixed issues for other versions of .

See also the release notes for the Cloud Monitoring Console app and the Admin Configuration Service for their respective known and fixed issues.

Version 9.0.2305

This version includes the following known issues:

Date filed or added	Issue number	Description
2024-08-27	SPL-261604	On-prem to Splunk Cloud transparent mode federated searches that use KVservice fail because the remote search head doesn't use the proxy bundle of the federated (local) search head. Workaround: If the failure is related to a lookup search not being resolved on the remote deployment, do this: Add local=true next to the invocation of the lookup in the search string. This addition forces the lookup to resolve on the local deployment and prevents the search from failing on the remote deployment. The remote deployment cannot access that lookup because the remote deployment uses KVservice, which does not engage in bundle replication.
2024-06-04	SPL-237180	Saved searches on Splunk Cloud Platform that are owned by nobody are scheduled using the default time zone settings in the user-prefs.conf file instead of the system time zone in Splunk Cloud. But, searches are run internally as splunk-system-user, which is tied to system time in Splunk Cloud Platform and is based on UTC (Coordinated Universal Time). The mismatch between the default time zone settings in the user-prefs.conf file and Splunk Cloud system time can lead to potential discrepancies in search results under certain conditions when the time zones for nobody and splunk-system-user get out of sync. If you're experiencing mismatched time zones with nobody owned searches following migration from Splunk Enterprise to Splunk Cloud Platform, reassign searches to a user account attached to a role, so searches aren't assigned to nobody. An alternative workaround is to set the schedules for nobody-owned saved searches to UTC, which ensures that searches are the same as system time.
2024-4-12	SPL-254077	CIDR match for tstats with ipv6 addresses isn't supported. The tstats command currently doesn't filter events with CIDR match on fields that contain IPv6 addresses. Running tstats searches containing IPv6 addresses might result in the following error indicating that the addresses are treated as non-exact queries: Error in 'TsidxStats': WHERE clause is not an exact query
2024-02-11	SPL-250916	Add a filter to the GET SHs only of all deployment clients in check_bundles_ready of dc_helpers.py.
2024-01-05	SPL-240774	The DELIMS setting or the kvdelim option may not be applied correctly when the k/v delim character appears 2 or more times in a field value Workaround: Perform field extractions by modifying your searches using other commands, such as the rex command or eval command.
2023-10-20	SPL-241475	False positive message that a restart is required. User 'admin' triggered the '_reload' action on app 'splunk_monitoring_console', and completing an implicit app deletion requires restart. No restart is required and this message can be ignored.
2023-08-02	SPL-242727, SPL-242744	Ingest Actions SSE-KMS "Test Connection" always fails. Workaround: After you follow all the steps in the Ingest Actions S3 destination wizard with KMS-encryption enabled, "Test Connection" will fail. To work around this: 1) Go to the Trust Relationship Policy entry in your customer-managed AWS S3 account. 2) Remove the "Condition" argument, such that this example: { "Version": "2023-01-01", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789098:role/abctest" }, "Action": "sts:AssumeRole", "Condition":{ "StringEquals":{ "sts.ExternalId": "12345abcde12345abcde12345abcde12345abcde12345" } } } ] } becomes like this instead: { "Version": "2023-01-01", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789098:role/abctest" }, "Action": "sts:AssumeRole" } ] } 3) Return to the Ingest Actions UI, and select "Test Connection" again. It should succeed, and you should be able to save your S3 destination. Note that, when using this workaround, sts.ExternalID (which is an optional field in the AWS assume role workflow) is not used while establishing a KMS-encrypted S3 write pathway between Ingest Actions and your customer-managed AWS S3 account. Following an upgrade to the next version, to be announced soon, perform these actions to clean up from the workaround: Case 1: If you already have some KMS-encrypted S3 destinations that were created using the workaround described above, it's best that you edit these existing destinations. In each of your existing S3 destinations: 1) Copy the Trust Policy blob and paste it into the Trust Relationship entry in your customer-managed AWS S3 account. 2) Save this configuration in your AWS S3 account. 3) Return to the Ingest Actions UI and select "Test Connection", and save the configuration on the Ingest Actions modal. Any new S3 destinations that you create with KMS encryption through the Ingest Actions UI will work seamlessly. Case 2: If you don't have any existing KMS-encrypted S3 destinations that were created using the Ingest Actions workflow listed in the first part of this document, then you don't need to do anything.
2023-07-26	SPL-242487	Dashboard charts do not support screen reader or keyboard navigation.
2023-07-20	SPL-240969	props and transforms created with 000-self-services (000-self-services/local/transforms.conf) as the destination app get removed during sync triggered by actions such as saving rulesets in Ingest Actions. Workaround: Do not save search time field transformations to the 000-self-services app. Move the existing 000-self-services/local/transformations.conf under a different app.
2023-07-19	SPL-242232	Dashboard Studio CSV Export does not wrap string values with quotes. If the value contains newlines, the resulting CSV does not correctly display when opened in tools such as Excel or Sheets. Workaround: Export CSV by opening in Search first and then exporting it from the Search page.
2023-07-07	SPL-241821	Data Model Accelerations that have Automatic Rebuilds enabled may lead to unbounded memory growth due to search expansion, resulting in Out of Memory errors Workaround: For a data model that is experiencing high memory usage, perform the following steps: On your Splunk platform deployment, in Splunk Web, select Settings and then Data Models. Select Edit for the data model that is experiencing high memory usage, and then select Edit Acceleration. Open Advanced Settings. Disable Automatic Rebuilds. See Accelerate data models in the Knowledge Manager Manual. Furthermore, applying index constraints to restrict the list of indexes searched for building a given DMA summary and applying tags allowlisting would help curtail the memory usage.
2023-07-05	SPL-241761	Dashboard Studio CSV Export only includes a limited number of rows corresponding to the first page of the table view. The resulting CSV file is incomplete without the table rows from other pages. Workaround: Export table rows by opening in Search instead of selecting Export.
2023-06-29	SPL-241368	Updating HEC token in Splunk Web with upper case 'Default' as the index causes an empty index to be set.
2023-05-30	Not applicable	ACS endpoint connections fail after June 4, 2023 or HEC sessions fail after June 14, 2023 with error messages that mention SSL, TLS, or HTTP error 503 or 525. See Cloud Platform Discontinuing support for TLS version 1.0 and 1.1.
2023-05-22	SPL-240242	Federated Search: When exporting results, the remote search head (RSH) returns exceptions when it sees federated search head (FSH) socket errors. The RSH should ignore FSH socket errors.
2023-05-10	SPL-239808	For customers on Google Cloud Platform (GCP), Splunk Secure Gateway does not work. All features including device management and registration are not functional.
2023-05-09	SPL-239689	In transparent mode Federated Search for Splunk, custom search commands and the "outputlookup" command should run only on the local deployment. Instead they run on the remote deployment, leading to errors, incorrect results.
2023-05-02	SPL-239436	In federated search, outputlookup existence check on RSH causes search to terminate early although it is not run on RSH in standard mode Workaround: Define the lookup on both federated search head and remote search head.
2023-04-28	SPL-239339	Workload Management ignores Place in Pool action.
2023-04-27	SPL-239293	Transparent Mode Federated Search: Check to turn off forwarding DMA or RA summarization search runs causes federated searches to fail.
2023-04-24	SPL-237902	Ad hoc searches that specify earliest relative time offset assuming from 'now' should explicitly include 'latest=now' to avoid a potential time range inaccuracy. Workaround: Ad hoc searches searches that use the earliest time modifier with a relative time offset should also include latest=now in order to avoid time range inaccuracies. For example, if you want to get all events from the last 10 seconds starting at 01:00:10, the following search returns all events that occur between the time of 01:00:00 and 01:00:10, as expected: index=main earliest=-10s latest=now. Running the same search without including latest=now might produce unpredictable results or impact performance in certain scenarios when the search head is overloaded with ad hoc searches. See Specify earliest relative time offset and latest time in ad hoc searches in the Splunk platform Search Manual.
2023-04-17	SPL-238767	Standard mode federated search with longer-than-a-minute from command searches might encounter socket ReadWrite errors when the federated provider points to a cloud load balancer, due to idle timeout on the LoadBalancer config Workaround: If you encounter this issue, update the federated provider definition (created on the federated search head in Splunk Web), so that its Remote Host points to a remote deployment cluster member instead of to the remote deployment cluster load balancer.
2023-04-14	SPL-238738	Federated search does not support the "Show Source" field action in either standard or transparent mode.
2023-03-14	SPL-237265	Sometimes when a search is aborted by workload rule, 'wlm_terminated' information message is not written to audit log
2022-08-23	SPL-228969	Federated Search: In Splunk Web federated index UI you cannot provide data model Dataset Name values that contain a dot ( . ) character Workaround: This is a limitation for users of standard mode federated search who want to set up federated indexes that map to data model datasets. It means that such users cannot set up federated indexes for data model datasets that are subordinate to a root dataset. For example, if the root data model dataset is Network_Traffic, you cannot map a federated index to the subordinate data model dataset Network_Traffic.All_Traffic. As a workaround, users can run tstats searches that use the nodename argument to filter out data that does not belong to a specific data model dataset: | tstats ... where nodename=Network_Traffic.All_Traffic.
2022-07-29	SPL-227633	Error : Script execution failed for external search command 'runshellscript' Workaround: The setting precalculate_required_fields_for_alerts=0 can be set on saved searches that have no other alert actions attached aside from the "Run A Script" action, to quash the error. For saved searches that have multiple alert action attached, this may not be safe as it will disable back propagation of required fields for all alert actions, which might result in the parent search extracting more fields than required, which could negatively impact performance for that search.
2022-06-15	SPL-226877	Federated Search UI Error: Cannot create saved search dataset for federated index if dataset name contains space Workaround: Use REST API to create the federated saved search instead: curl -k -u <username>:<password> -X POST https://localhost:8089/servicesNS/nobody/search/data/federated/index -d name=federated:index_kathy -d federated.dataset='savedsearch:ss with space' -d federated.provider=remote_deployment_1. See Federated search endpoint descriptions in the REST API Reference Manual.
2022-02-25	SPL-219793	Some commands in federated searches return incorrect resultCount values when run in Verbose mode Workaround: Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode. Search-time field extraction usually requires searches without transforming commands that run in either Verbose or Smart mode. When you run searches in Fast mode, you can ensure that search-time field extraction takes place for federated searches by appending | fields * to the ends of your searches.
2022-02-08	SPL-218842	Some reporting commands in federated search return incorrect eventCount Workaround: Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode. Search-time field extraction usually requires searches without transforming commands that run in either Verbose or Smart mode. When you run searches in Fast mode, you can ensure that search-time field extraction takes place for federated searches by appending | fields * to the ends of your searches.
2021-04-30	SPL-205069	onunloadCancelJobs failed to cancel search job on Safari Workaround: Use another browser such as Chrome or Firefox

This version fixes the following issues:

Date filed or added	Issue number	Description
2023-08-02	SPL-242727, SPL-242744	Ingest Actions SSE-KMS "Test Connection" always fails. (Fixed in 9.0.2305.2xx)
2023-06-29	SPL-241274	Dashboard Studio fails to load dashboards and displays the error "Cannot convert undefined or null to object" when search results return "null" values.
2023-06-14	SPL-240966	Classic Simple XML dashboards parsing error: "Cannot convert undefined or null to object".
2023-05-22	SPL-240242	Federated Search: When exporting results, the remote search head (RSH) returns exceptions when it sees federated search head (FSH) socket errors. The RSH should ignore FSH socket errors. (Fixed in 9.0.2305.2xx)
2023-05-18	SPL-240082	Classic Simple XML dashboards with HTML panels using external images and tokens show the error "Awaiting User Confirmation".
2023-04-27	SPL-239293	Transparent Mode Federated Search: Check to turn off forwarding DMA or RA summarization search runs causes federated searches to fail. (Fixed in 9.0.2305.2xx)
2023-04-11	SPL-238512	The federated search UI does not support mapping federated indexes to data model datasets that have dot characters in their names.
2023-03-30	SPL-238029	Standard mode federated search - A multistats search with a tstats subsearch where prestats=t and a federated index is used as a data model throws an error.
2023-03-28	SPL-237883	Transparent Mode federated search - Using table and stats in the same federated search causes the search to return empty results.