Splunk® Universal Forwarder

Forwarder Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Forwarder. Click here for the latest version.
Acrobat logo Download topic as PDF

Fixed issues

The following issues were fixed in maintenance releases of the universal forwarder.


Version 6.4.8 was released on June 21, 2017.

This release does not fix any new universal forwarder issues.


Version 6.4.7 was released on April 24, 2017.

Date resolved Issue number Description
2017-03-30 SPL-140544, SPL-135562 Universal forwarder on AIX attempts to start splunkweb during internally-triggered restart, warns that "SRC did not 'stopsrc splunkweb'".


Version 6.4.6 was released on February 23, 2017.

Date resolved Issue number Description
2017-01-19 SPL-135019, SPL-134112 Unactionable error message for invalid server URIs in outputs.conf.
2017-01-06 SPL-134071, SPL-117117 Splunk Forwarder Service terminated unexpectedly occurs on several customer's environment
2016-12-06 SPL-132960, SPL-120612 Splunk Universal Forwarder on AIX 7.1 crashes when host not listed in AcceptFrom in inputs.conf file on indexers
2016-12-01 SPL-132620, SPL-128710 Having many forwarders, forwarding to an intermediate forwarder, can result in intermediate crashing in certain scenarios


Version 6.4.5 was released on December 15, 2016.

Date resolved Issue number Description
2016-11-14 SPL-130802, SPL-129109 Improper line breaking of IIS logs
2016-11-01 SPL-127436, SPL-131210, SPL-131405 syslog forwarding does not work with IPv6+UDP connection


Version 6.4.4 was released on October 3, 2016. This release fixes the following issue.

Date resolved Issue number Description
2016-08-30 SPL-127095, SPL-123187, SPL-127079 Duplicate events with indexerDiscovery following outages on indexer cluster.


Version 6.4.3 was released on August 22, 2016. This release fixes the following issue.

Date resolved Issue number Description
2016-07-05 SPL-123781
Dropped events messages in splunkd are INFO; should be WARN.


Version 6.4.2 was released on July 11, 2016. This release fixes the following issue.

Date resolved Issue number Description
2016-06-07 SPL-121336
UF crashes in populate_VolumesIdata when constructing IndexerService object.


Version 6.4.1 was released on May 18, 2016. This release fixes the following issues.

Date resolved Issue number Description
2016-05-18 SPL-118187 Universal forwarder stops sending events due to TCP failover.
2016-05-08 SPL-118661 When forwarding to both standalone and indexerDiscovery, only cluster peers have data.
Last modified on 13 October, 2017
Known issues
Third-party software

This documentation applies to the following versions of Splunk® Universal Forwarder: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters