Known issues for DSP
This version of the Splunk Data Stream Processor has the following known issues and workarounds.
If no issues appear here, no issues have yet been reported.
|Date filed||Issue number||Description|
|2021-12-03||DSP-43606||Server can be attacked by slow clients during TLS handshake|
|2021-09-02||DSP-41953||DSP's messaging bus does not write to a write-ahead log by default. In some cases, this may cause data loss.|
|2021-08-04||DSP-41040||Checkpoint cleanup for pull-based connectors cause performance issues.|
|2021-06-01||DSP-38591||Subseconds are not sent to Firehose|
|2021-02-23||DSP-34031||In HEC sink, unhandled exception causes pipeline restarts|
|2020-12-15||DSP-31160||HEC sink leaks memory when ACK is disabled|
|2020-12-09||DSP-30903||HEC Sink throws ArrayOutOfBoundException eventually|
|2020-10-19||DSP-28395, DSP-28139||You cannot reactivate a pipeline if you do a round-trip toggle from Canvas -> SPL -> Canvas.|
If you are editing a pipeline that has been activated before, stay in the Canvas builder.
|2020-09-18||DSP-26912||Generated SPL can erroneously duplicate statement names when statement names of the form statement_n are hard-coded in the Pipeline JSON.|
Change the hard-coded statement names in the Pipeline JSON to something that does not match statement_n.
|2020-09-17||DSP-26854||To_Splunk_JSON and the Write to Splunk with Batching functions do not handle timestamp and host fields correctly for metrics data. Timestamps are converted incorrectly and the host field is dropped.|
|2020-07-07||DSP-23540||Viewing or previewing a pipeline with more than 6 functions may result in a "500 - Unable to retrieve metrics error"|
|2020-05-14||DSP-21237, DSP-21236||Enable compression when publising to Pulsar release-1.1|
|2020-05-12||DSP-21094||NOT cannot be used with scalar functions|
Use the equality check operator instead.
Eg: match_regex(host, /foo/) != true
|2020-05-07||DSP-21005||Function with arguments of type expression cannot be used with argument value null in the SPL2 Pipeline Builder.|
Use DSP UI Canvas to load the affected pipeline, manually add null in the expression box where the null argument value is needed.
|2020-05-06||DSP-20937||Upgrading directly from 1.0.0 to 1.1.0 fails|
Upgrade to 1.0.1 first, then upgrade to 1.1.0.
|2020-05-01||DSP-20799, DSP-25154||Users should not need to start a preview job to compile SPL to UPL|
Configure every function so the UPL is valid.
|2020-04-30||DSP-20769||Migration prompt continues to show up after an active pipeline is migrated to a new API version.|
|2020-04-29||DSP-20692||Going from Canvas to SPL and back could populate optional arguments with SPL default values|
|2020-04-24||DSP-20522||Ingest API endpoints should reject requests with a payload greater than 5 MB|
|2020-04-21||DSP-20372, DSP-19212||Variable assignments are renamed when toggling between SPL to Canvas to SPL|
This issue has no functional impact.
|2020-04-21||DSP-20380||When toggling between the Canvas Builder and SPL2 Builder, function configurations are unexpectedly populated with default values.|
Configure every function so the UPL is valid.
|2020-04-21||DSP-20379||User named functions are lost when toggling between the Canvas and the SPL2 Builders.|
|2020-04-20||DSP-20302||Pod DNS resolution intermittently fails during startup on Ubuntu 16.04|
When the cluster is starting for the first time, some DNS queries can fail. The system will eventually recover, but this can take a long time.
Example error condition:
ERROR unexpected error when resolving host 'minio-5.minio': lookup minio-5.minio on 10.100.114.12:53: no such host
In order to speed up the process, identify and restart the failing pods. This problem commonly affects the minio statefulset, and can be remedied by deleting the failing pod.
kubectl delete pod minio-5 -n dsp
|2020-04-16||DSP-20161||Do not allow user to toggle to UI Form mode of a custom function on invalid entry in SPL expression tab|
This issue arises when the user creates a Custom Function in the UI, and incorrectly edits an SPL Expression in the "SPL Expressions" tab in the function's configuration panel.
To resolve this issue, configure SPL Expressions in Custom Functions correctly.
|2020-04-08||DSP-19759||DSP does not properly ingest sourcetypes with INDEXED_EXTRACTIONS=true.|
|2020-02-10||DSP-17563||Unable to upgrade a DSP cluster if the hosts have 6GB or less of free space on the root volume|
Choose a different directory to write temporary files to during the upgrade process. Run the following command in your cluster.
|2019-11-08||DSP-14655||After updating UI cert and deploying, nginx did not automatically restart.|
Manually delete the dsp-reverse-proxy pod, and it will pick up the new configuration.
|2019-07-31||DSP-11076||The filter in preview results does not work.|
New features for DSP
Fixed Issues for DSP
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0