Release notes for the Splunk Add-on for Windows

Version 9.0.1 of the Splunk Add-on for Windows was released on November 13, 2024.

The Splunk Add-on for Windows DNS version 1.0.1 and the Splunk Add-on for Windows Active Directory version 1.0.0 are not supported when installed alongside the Splunk Add-on for Windows versions 6.0.0 and higher. The Splunk Add-on for Windows versions 6.0.0 and higher includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory.

Compatibility

Version 9.0.1 of the Splunk Add-on for Windows is compatible with the following software, CIM versions, and platforms:

Splunk platform versions	9.0.x
CIM	4.15 and later
Platform	Windows
Vendor Products	Windows Server 2022, Windows 11, Windows Server 2019, Windows 8.1, Windows 10, Windows Server 2012/2012 R2, Windows Server 2016, Microsoft Active Directory, Microsoft Windows DNS Server

New or changed features

Version 9.0.1 of the Splunk Add-on for Windows has the following new or changed features:

Updated extraction logic for the parent_process field to ensure that the field is extracted if it has not been previously extracted for the XmlWinEventLog sourcetype. This change allows both Sysmon and Windows add-on users to utilize the Sysmon add-on parent_process field extraction, without affecting Windows add-on users.

Fixed Issues

Version 9.0.1 of the Splunk Add-on for Windows fixes the following issues:

Known Issues

Version 9.0.1 of the Splunk Add-on for Windows contains the following known issues. If no issues appear below, no issues have yet been reported: