Splunk® Data Stream Processor

Release Notes

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of DSP. Click here for the latest version.
Acrobat logo Download topic as PDF

Known issues for DSP

This version of the Splunk Data Stream Processor has the following known issues and workarounds.

If no issues appear here, no issues have yet been reported.

Date filed Issue number Description
2021-12-03 DSP-43606 Server can be attacked by slow clients during TLS handshake
2021-09-02 DSP-41953 DSP's messaging bus does not write to a write-ahead log by default. In some cases, this may cause data loss.
2021-08-04 DSP-41040 Checkpoint cleanup for pull-based connectors cause performance issues.
2021-06-01 DSP-38591 Subseconds are not sent to Firehose
2021-02-23 DSP-34031 In HEC sink, unhandled exception causes pipeline restarts
2020-12-15 DSP-31160 HEC sink leaks memory when ACK is disabled
2020-12-09 DSP-30903 HEC Sink throws ArrayOutOfBoundException eventually
2020-10-19 DSP-28395, DSP-28139 You cannot reactivate a pipeline if you do a round-trip toggle from Canvas -> SPL -> Canvas.

If you are editing a pipeline that has been activated before, stay in the Canvas builder.
2020-09-18 DSP-26912 Generated SPL can erroneously duplicate statement names when statement names of the form statement_n are hard-coded in the Pipeline JSON.

Change the hard-coded statement names in the Pipeline JSON to something that does not match statement_n.
2020-09-17 DSP-26854 To_Splunk_JSON and the Write to Splunk with Batching functions do not handle timestamp and host fields correctly for metrics data. Timestamps are converted incorrectly and the host field is dropped.
2020-07-07 DSP-23540 Viewing or previewing a pipeline with more than 6 functions may result in a "500 - Unable to retrieve metrics error"
2020-05-14 DSP-21237, DSP-21236 Enable compression when publising to Pulsar release-1.1
2020-05-12 DSP-21094 NOT cannot be used with scalar functions

Use the equality check operator instead.

Eg: match_regex(host, /foo/) != true

2020-05-07 DSP-21005 Function with arguments of type expression cannot be used with argument value null in the SPL2 Pipeline Builder.

Use DSP UI Canvas to load the affected pipeline, manually add null in the expression box where the null argument value is needed.
2020-05-06 DSP-20937 Upgrading directly from 1.0.0 to 1.1.0 fails

Upgrade to 1.0.1 first, then upgrade to 1.1.0.
2020-05-01 DSP-20799, DSP-25154 Users should not need to start a preview job to compile SPL to UPL

Configure every function so the UPL is valid.
2020-04-30 DSP-20769 Migration prompt continues to show up after an active pipeline is migrated to a new API version.
2020-04-29 DSP-20692 Going from Canvas to SPL and back could populate optional arguments with SPL default values
2020-04-24 DSP-20522 Ingest API endpoints should reject requests with a payload greater than 5 MB
2020-04-21 DSP-20372, DSP-19212 Variable assignments are renamed when toggling between SPL to Canvas to SPL

This issue has no functional impact.
2020-04-21 DSP-20380 When toggling between the Canvas Builder and SPL2 Builder, function configurations are unexpectedly populated with default values.

Configure every function so the UPL is valid.
2020-04-21 DSP-20379 User named functions are lost when toggling between the Canvas and the SPL2 Builders.
2020-04-20 DSP-20302 Pod DNS resolution intermittently fails during startup on Ubuntu 16.04

When the cluster is starting for the first time, some DNS queries can fail. The system will eventually recover, but this can take a long time.

Example error condition:

  1. kubectl logs minio-5 -n dsp -p

ERROR unexpected error when resolving host 'minio-5.minio': lookup minio-5.minio on no such host

In order to speed up the process, identify and restart the failing pods. This problem commonly affects the minio statefulset, and can be remedied by deleting the failing pod.

Example workaround: kubectl delete pod minio-5 -n dsp

2020-04-16 DSP-20161 Do not allow user to toggle to UI Form mode of a custom function on invalid entry in SPL expression tab

This issue arises when the user creates a Custom Function in the UI, and incorrectly edits an SPL Expression in the "SPL Expressions" tab in the function's configuration panel.

To resolve this issue, configure SPL Expressions in Custom Functions correctly.

2020-04-08 DSP-19759 DSP does not properly ingest sourcetypes with INDEXED_EXTRACTIONS=true.
2020-02-10 DSP-17563 Unable to upgrade a DSP cluster if the hosts have 6GB or less of free space on the root volume

Choose a different directory to write temporary files to during the upgrade process. Run the following command in your cluster.

export TMPDIR=/<directory-on-larger-volume>

2019-11-08 DSP-14655 After updating UI cert and deploying, nginx did not automatically restart.

Manually delete the dsp-reverse-proxy pod, and it will pick up the new configuration.
2019-07-31 DSP-11076 The filter in preview results does not work.
Last modified on 13 August, 2022
New features for DSP
Fixed Issues for DSP

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters