Splunk Stream

Release Notes

This documentation does not apply to the most recent version of Splunk Stream. For documentation on the most recent version, go to the latest release.

Known issues

Known issues in Splunk App for Stream 6.0.2:

Publication date Defect number Description
2015-10-21 STREAM-2268 imap "password" field is missing.
2015-10-21 STREAM-2222 Stream tries to open pcap adapter on inactive interface.
2015-10-21 STREAM-2193 The stream id (labeled 'Name' in the Configure Streams UI) is case sensitive. This lets you create a stream with the same name as a default stream, for example, id "HTTP", which you can confuse with the default stream id "http."
2015-10-21 STREAM-2190 Stream Forwarder skips IP packets with zero length (ip.len==0) in the IP header.
2015-10-21 STREAM-2183 request_time, reply_time, and response_time flow metrics are not populated for all protocols.
2015-10-21 STREAM-2179 Sparkline in Configure Streams UI under certain circumstances incorrectly shows zero traffic volume for protocols.
2015-10-21 STREAM-2169 SSL key stored in local/directory.
2015-10-21 STREAM-2156 streamfwd process may exhibit unbounded memory growth when running on Splunk Universal Forwarder instance that is unable to forward events, most commonly because of incorrect tcpout parameters in outputs.conf configuration.
2015-10-21 STREAM-1834 Inefficient captured packet queueing.
2015-08-07 STREAM-2190 SDSSL skips IP packets with zero length (ip.len==0) in the IP header.
2015-04-19 STREAM-1913 Splunkd does not reliably shut down streamfwd process.
2015-04-19 STREAM-1909 SNMP events not returning key pieces of data due to lack of parsing from original binary format.
10/30/14 STREAM-1438 The dssl session packet_time does not get updated as expected. This causes an incorrect value for the time_taken attribute.
10/30/14 STREAM-1426 Due to an invalid check for UDP header size, the app generates an invalid UDP packet, which causes the streamfwd binary to crash.
10/30/14 STREAM-1421 Tcp Reassemble Payload Size graph does not work with multiple processor threads.
10/30/14 STREAM-1409 When user blacklists the specific IP address 173.255.123.123, an error appears stating the octet cannot be 255.
10/30/14 STREAM-1408 User cannot modify XMPP protocol configuration due to absence of app=XMPP parameter.
10/30/14 STREAM-1400 User can create a clone without a name, without error, but no stream appears. This produces a blank line in the Streams list upon Splunk restart.
10/30/14 STREAM-1402 Stream generates bogus call_status=TIMEOUT callbacks for SIP protocol sessions.
10/30/14 STREAM-1397 If you clone a stream without providing a description, a blank space appears in the Stream dropdown of the dialog box that opens when you click the "Clone Stream" button on the main Streams Config page.
10/30/14 STREAM-1345 Non-applicable flow terms (such as flow.protocol, flow.data-center-time, flow.ssl* and flow.rtt* ) appear in application-level vocabularies.
10/30/14 STREAM-1317 In the Streams Config SMTP protocol UI, the "duration" field description incorrectly states "Duration of SMTP session in seconds." Should be microseconds.
10/30/14 STREAM-1297 If you modify a built-in (default) stream, the stream displays as "CLONED" in the Streams Config UI. This enables the delete function, which in this case deletes the stream modifications and returns the stream to its original state.
10/30/14 STREAM-1294 Missing events for IMAP protocol.
10/30/14 STREAM-1289 "Hide credit card" feature does not allow custom configuration.
10/30/14 STREAM-1283 Event reporting incorrect for POP3 protocol.
10/30/14 STREAM-1203 Flow metrics calculations inaccurate for MAPI protocol.
10/30/14 STREAM-1185 Stream might generates "empty" TCP flow events (sourcetype=stream:tcp) with bytes_in=0 bytes_out=0 packets_in=0 packets_out=0.
10/30/14 STREAM-1182 Unexplained "DPI error processing stream data" messages appear in streamfwd.log.
10/30/14 STREAM-1181 Missing events for Radius protocol.
Last modified on 22 October, 2015
  Fixed Issues

This documentation applies to the following versions of Splunk Stream: 6.0.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters