Known issues for Splunk App for Infrastructure

The Splunk App for Infrastructure version 1.3.0 has the following known issues.

Date filed	Issue number	Description
2019-07-01	SII-4834	Power users can't write to the infra_alerts index. Workaround: Manually enable power users to write to the infra_alerts index.
2019-06-28	SII-4832, SII-4831	libcurl4 is incompatible with the write_splunk collectd plugin. This affects Ubuntu 18.04. Workaround: Replace libcurl4 with libcurl3.
2019-05-30	SII-4520	The em_send_email script fails to send email alerts to the SMTP server as the "no-reply@splunk.com" sender. Workaround: Upgrade to 1.3.1 or later, and go to the splunk email setting to specify a valid sender in "send email as". In  _\splunk_app_infrastructure\bin\em_common.py_ : edit line 54: return url.endsWith('cloud.splunk.com') or url.endsWith('splunkcloud.com') Change the line to make the 'Ws in endsWith to lower case: endswith. e.g. return url.endswith('cloud.splunk.com') or url.endswith('splunkcloud.com')
2019-04-29	SII-4145	From the Add Data tab, if you select a new operating system and then go back to the previous one, the selected log and metrics sources may not be accurate. Your log and metrics settings persist in the script but not the user interface.
2019-04-29	SII-4143	The write_splunk plug-in for collectd fails to connect because of an SSL connect error. Workaround: Update NSS Network Security Services (NSS) to the latest version: $ yum update nss
2019-04-19	SII-4059	The easy install script for a Debian host fails after running the removal script.
2019-04-19	SII-4058	The data collection script for Mac OS X does not install collectd.
2019-04-19	SII-4060	When you configure the data collection script to collect metrics and logs on a *nix system, the script does not install the log collection agent properly. Workaround: When you are configuring the easy install script from the *Add Data* page, deselect all log sources under the *Data to be collected* setting. To collect logs, configure inputs manually.
2019-04-17	SII-4034	The data collection script for Mac OS X prompts you to enter your password multiple times.
2019-04-17	SII-4031	Collectd fails to install on Mac OS X. Workaround: 1. Ensure that Homebrew can access required directories by giving the user some new permissions:      $ sudo chown -R "$USER":admin /usr/local      $ sudo chown -R "$USER":admin /Library/Caches/Homebrew  2. Delete the old Homebrew directory and start again:      $ sudo rm -R /usr/local/Homebrew
2019-04-12	SII-3931	The sc_admin role has insufficient permissions to create alerts and configure data collection.
2019-04-05	SII-3923	Settings > Restart Splunk does not restart Splunk Enterprise.
2019-04-03	SII-3915	You cannot customize email settings using Splunk Enterprise email notification settings.
2019-04-03	SII-3921	Separate CloudWatch logs are combined in the Analysis Workspace.
2019-04-02	SII-3907	If you return to view the Group Analysis Workspace for a group after you delete it, the page does not stop attempting to load.
2019-03-27	SII-3893	Collection intervals for Windows and Linux OS metrics.
2019-03-27	SII-3892	pagination issue when deleting in bulk
2019-02-22	SII-3710	The Splunk Add-on for Windows is not compatible with the Splunk App for Infrastructure. Workaround: To use the Splunk Add-on for Windows and the Splunk App for Infrastructure together, see The Splunk Add-on for Windows and Splunk App for Infrastructure are not compatible in the Administer Splunk App for Infrastructure guide.
2019-01-29	SII-3520	From the Alerts tab, when you select the Groups view with thousands of groups, the groups may not load properly.
2018-11-30	SII-3258	The default value of info threshold is MAX integer value and it is confusing
2018-09-21	SII-2924	The Entity Overview does not properly display metrics values.
2018-07-11	SII-2487	The side panel may show alerts that no longer exist.

Splunk platform issues that impact Splunk App for Infrastructure compatibility

Date resolved	Issue number	Description
2019-03-07	SPL-167347, 165968	Frequent searches with outputlookup may trigger highly increased KV Store storage usage or in some cases crash of the mongod process. If you are experiencing this issue, upgrade your Splunk software: Splunk Enterprise to version 7.2.5 or later Splunk Cloud to version 7.2.6