Known issues

This topic lists known issues that are specific to the universal forwarder. For information on fixed issues, see Fixed issues.

Universal forwarder issues

Date filed	Issue number	Description
2024-02-22	SPL-251517, SPL-237849	CHECK_METHOD = modtime not working as expected in ver. 9.0.4 upgrading from 8.2.7. Workaround: time_before_close=0 [1] Upgrade to version 9.0.0.1 issue doesn't appear. [2] The detailed workaround didn't solve the issue.
2024-02-22	SPL-251515, SPL-237849	CHECK_METHOD = modtime not working as expected in ver. 9.0.4 upgrading from 8.2.7. Workaround: time_before_close=0 [3] Upgrade to version 9.0.0.1 issue doesn't appear. [4] The detailed workaround didn't solve the issue.
2024-02-22	SPL-251516, SPL-237849	CHECK_METHOD = modtime not working as expected in ver. 9.0.4 upgrading from 8.2.7. Workaround: time_before_close=0 [5] Upgrade to version 9.0.0.1 issue doesn't appear. [6] The detailed workaround didn't solve the issue.
2024-02-20	SPL-251301	Unable to install/upgrade Splunk Enterprise & UF RPM package v9.2.x on the same server.
2023-12-19	SPL-248587, SPL-252796, SPL-252797	Unable to install or upgrade to Splunk Universal Forwarder version 9.1.3 Workaround: Install UF while passing the following feature flag: msiexec.exe /i $SPLUNK_MSI_PACKAGE USE_LOCAL_SYSTEM=1
2022-08-17	SPL-228646, SPL-228645	Restart is needed when AWS access key pairs rotate (w/o grace period) or other S3 config settings for Ingest Actions become invalid
2022-06-23	SPL-226019	Warning appears in the universal forwarder whenever any spl command is run: Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforwarder". This warning is expected and will not affect functionality.
2022-03-23	SPL-221239	System Introspect App fails when universal forwarder is installed at non-admin user