Release notes for the Splunk Add-on for Windows

Version 8.9.0 of the Splunk Add-on for Windows was released on July 15, 2024.

The Splunk Add-on for Windows DNS version 1.0.1 and the Splunk Add-on for Windows Active Directory version 1.0.0 are not supported when installed alongside the Splunk Add-on for Windows versions 6.0.0 and higher. The Splunk Add-on for Windows versions 6.0.0 and higher includes the Splunk Add-on for Windows DNS and the Splunk Add-on for Microsoft Active Directory.

Compatibility

Version 8.9.0 of the Splunk Add-on for Windows is compatible with the following software, CIM versions, and platforms:

Splunk platform versions	9.0.x
CIM	4.15 and later
Platform	Windows
Vendor Products	Windows Server 2022, Windows 11, Windows Server 2019, Windows 8.1, Windows 10, Windows Server 2012/2012 R2, Windows Server 2016, Microsoft Active Directory, Microsoft Windows DNS Server

New or changed features

Version 8.9.0 of the Splunk Add-on for Windows has the following new or changed features:

• Enhanced CIM mapping for Windows Event Codes 5156, 5157, 4798, 17, 18, 19. See Common Information Model and Field Mapping Changes for the Splunk Add-on for Microsoft Windows for more information.
• Enhanced signature field extraction for all events in WinEventLog and XmlWinEventLog sourcetypes.
• Fixed duplication issue in WindowsUpdateLog input.
• Fixed extraction of member_user_name field to include the full name in event code.
• Fixed issue where the sourcetype was not getting renamed to WinEventLog/XmlWinEventLog when the Windows EventLog channel being monitored contained slashes in its name.

Fixed Issues

Version 8.9.0 of the Splunk Add-on for Windows fixes the following issues:

Known Issues

Version 8.9.0 of the Splunk Add-on for Windows contains the following known issues. If no issues appear below, no issues have yet been reported: