Splunk Stream

Release Notes

This documentation does not apply to the most recent version of Splunk Stream. For documentation on the most recent version, go to the latest release.

Known issues

Version 7.1.3 of Splunk Stream contains the following known issues.

If no issues appear below, no issues have yet been reported:

Date filed Issue number Description
2020-01-06 STREAM-4301, STREAM-4409 Windows: Capture stops with "pcap_loop returned error code -1 read error: PacketReceivePacket failed; network capture stopped" and isn't restarted

Workaround:
Re-configure one of the streams assigned to the forwarder in the Stream app, for example, you can add/enable a dummy stream and disable it again later, or change on of the configuration options for an existing Stream

https://docs.splunk.com/Documentation/StreamApp/latest/User/ConfigureStreamsMetadata or restarting Splunk Forwarder service in Windows, for example through services.msc

Sample scenario where you might run into this: Reconfiguration of the NIC while Stream is running (for example, changing the flow control mode in our testing)

2019-10-28 STREAM-4231 DPI error processing stream data invalid param error code(- 1) too many uapp_cnx attached to the dpi_flow (see external_max_tunnel params) in afc_process_uappcnx_retrieve udp error message
2019-09-10 STREAM-4170 Splunk stream 7.1.3-35 + does not process Netflow options-Template
2019-08-28 STREAM-4165 Stream 7.1.3.222 kvstore_debug.py Now ask for the username twice.
2019-06-27 STREAM-4124 "SSL decryption error (DSSL library error code -41) ]" while decrypting traffic
2019-06-11 STREAM-4110, SOLNESS-17442 Stream SSL and DNS Activity views are exported globally

Workaround:
Please prevent the Splunk app for Stream from exporting views globally via local metadata override.


 # 
 ## in ../apps/splunk_app_stream/local.meta
 [views]
 export = none
 
2019-05-15 STREAM-4094 Netflow Event Collection - does not process some records
2019-04-15 STREAM-4054 When disabling SplunkWeb SSL, Configure Streams page in Stream app does not display the streams
2019-04-09 STREAM-4052 When splunkd and splunk web has SSL enabled ephemeral streams will not populate

Workaround:
Work around for this issue:-

Make sure that in web.conf under [settings] , this param "enableSplunkWebSSL" has values in this format -

[settings] enableSplunkWebSSL = <boolean>

e.g.  [settings] enableSplunkWebSSL = true  OR  [settings] enableSplunkWebSSL = false

Last modified on 15 February, 2022
Fixed issues   Boost C++

This documentation applies to the following versions of Splunk Stream: 7.1.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters