Fixed Issues

• depedency_manager.py conflicted with Unix App. When installing Splunk App for Stream on a system that runs Splunk App for Unix, the dependency_manager.py script that comes with App for Stream conflicted with the dependency_manager.py script that comes the Unix app. This prevented Splunk from running the script and broke the Splunk_TA_stream install process. (STREAM-1128)

• When running Splunk App for Stream on Splunk Enterprise 6.0: On the Configure Streams page, when you clicked Add and selected a comparison from the drop-down, the filters modal dialog disappeared. This forced you to reload the page and made it not possible to configure filters. (STREAM-1138)

• The following fields were being recorded as timestamps. They should be recorded as integers representing a total number of microseconds. (STREAM-1097)

• dns.response-time
• smtp.duration
• ftp.transfer-duration
• sip.session-duration
• sip.call-duration
• sip.setup-delay
• sip.time-before-spk

• On the Configure Streams page, exiting a modal by clicking on backdrop instead of cancel caused issues between the different modals. Clicking on the backdrop removed the modal, but then when you opened a different modal the old modal was stacked on top. Clicking the backdrop is now the same as clicking cancel. (STREAM-1115)

• With full content enabled, it was possible for Stream’s modular input to generate events larger than 64MB. This causes splunkd to lock-up and require a restart. A sanity check has been added to ensure it will not emit events beyond this threshold. Instead, it now logs an error message. (STREAM-1136)

• App for Stream did not recognize if the default splunkd root_endpoint is changed via [settings] in web.conf. This causes the Wire data input to be configured with an incorrect URL. (STREAM-1137)

• The nfs.mode field was being recorded as an integer. It should be recorded as an octal number. (STREAM-1092)

• The string comparison types for filters was missing “exactly matches.” Also, we’ve removed tertiary forms of string comparisons, and the drop-down menu for all comparison types now uses more human-friendly strings. (STREAM-1109)