Splunk® Enterprise

Release Notes

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


Splunk 5.0.5 was released on September 22, 2013.

The following issues have been resolved in this release:

Resolved security issues

The following security issue has been resolved in version 5.0.5:

  • Abuse of a test script mechanism to execute shell code (SPL-70250)

For more information, refer to this posting on the Splunk Security Portal.

Resolved data input issues

  • Very busy logfiles which are "rotated" with the copy-truncate pattern can lead to partial logfile re-indexing minutes to hours after the copy+truncate occurs. The duplication will consist of all events from the file start to some point in the middle of the file. (SPL-70749)
  • Compressed data is re-indexed multiple times if the compressed file is > 256 bytes. (SPL-69770)
  • Splunk fails to index a file ending with a capital letter .ZIP extension; lower case .zip works. (SPL-68226)
  • WinEventLog InputChannel stops collecting data due to constant timeout and must be restarted. (SPL-64915)
  • Perfmon events ingested by a universal forwarder do not have a valid extracted timestamp. (SPL-63796)
  • TIME_FORMAT parameter specified in 'data preview' window not honored if spaces present until splunkd is restarted. (SPL-68420)

Resolved charting issues

  • Right clicking on chart and selecting print freezes all versions of IE. (SPL-71276)
  • List of enabled chart types is incorrect for commands like timechart, top, rare. (SPL-55112)
  • legend.placement=right in JSChart cause detail truncated if we set height=100% and browser has small height. (SPL-66919)

Resolved integrated PDF generation issues

  • After migration to 5.x, generating PDFs from a saved search generate error: An error occurred when trying to generate PDF - ssName and pdfViewID unavailable. (SPL-69407)

Resolved index replication issues

  • The percentage of total peers to restart during a rolling restart is now configurable. Refer to this topic for more information. (SPL-70814)
  • Cluster becomes unsearchable after killing some peers. (SPL-70888)
  • Clustering dashboard shows cluster to be 'Not Completely Searchable' but master has already committed generation. (SPL-70802)
  • Cluster master assumes bucket is present in a peer and crashes every few minutes. (SPL-70512)
  • Need control over display of warning Banner "ACK not enabled on forwarder" when clustering is on. (SPL-71482)
  • clustering peers do not receive heartbeat when clock on the master goes backwards. (SPL-69479)

Resolved search, saved search, alerting, scheduling, and job issues

  • Using mode=sed with the rex command does not replace characters with '\' value correctly (SPL-55549)
  • Show Source" option is not available when using "fields" command because the events api is missing _cd, _si fields. (SPL-61651)
  • Search process seems to be caught in a loop due to "Max Raw Size Limit Exceeded", never ends. (SPL-70794)
  • Dispatch reaper fails to reap search artifacts when oversubscribed with bundle reaping activity. (SPL-71625)
  • Search does not auto-finalize on first run when using Google Frame extension on IE. (SPL-70971)
  • Can not export all events using unlimited export feature in Splunk Web. (SPL-68343, SPL-59215)
  • Running stats AS * does not return correct number of events. (SPL-67410)
  • Can't use private macro in a map command. (SPL-66265)
  • Search tag=<tag name> not showing correct results. (SPL-47120)
  • The multikv command does not set linecount field correctly when splitting up events and causes erroneous "collapse back to 10 lines" link in Splunk Web. (SPL-38179)

Resolved Splunk Web and Manager interface issues

  • The root_endpoint is not working if you log out and then re-log in to Splunk Web because Splunk Web is setting the location of response header as / and not as the value set in root_endpoint of web.conf. (SPL-70334)
  • Manager > Licensing page taking too long to load. (SPL-71147)
  • Splunk Web generates an "event" file if exporting the results in a Chinese character filename rather than the Chinese character file. (SPL-68227)
  • A search being rendered into a SimpleResultsTable will have status_buckets set to at least 1 for the search feeding it. Often this API parameter is unnecessary, and can have negative effects on performance. (SPL-66501)
  • If you use both real-time search and postprocessing in an event module, an error "Negative offsets are not allowed when a postprocessing search is specified" is displayed. (SPL-62459)
  • The Next link in Splunk Web should be grayed out after displaying by default 10K events in 4.3.x and 1K events in 5.0.x. Clicking Next at this point will display an empty page. (SPL-64905)

Resolved distributed deployment, forwarder, and deployment server issues

  • In splunkd.log, deployment client debug message says: DEBUG DeploymentClient - Handshake not yet finished. will continue retrying with a rate of '60000 secs'. The value 60000 is in msec and not secs. (SPL-70584)
  • Updating assets.csv causes the restart message to be displayed in Splunk Web. (SPL-71121)
  • Deployment server initiating a restart after application deployment, and Windows based UF takes longer than Windows allows (30 seconds). SPL-61193
  • The server.conf spec file fails to indicate that search head pooling parameters cannot be specified in apps hosted on the shared storage. (SPL-72069)
  • Search head pooling: Build event type page shows error: "Unable to get sample events: local variable 'f' referenced before assignment". (SPL-70870)
  • UF forwarding data in load balancing mode is sending twice more to one specific indexer in the list. (SPL-69922)
  • Once a connection fails to the license master, it refuses all subsequent license-slave connections with HTTP server 500 error. (SPL-61116)
  • Deployment client fails to download apps when appname, servername, tenant class name contain space. (SPL-38923)

Resolved Windows-specific issues

  • A problem with the deployment client can cause a Windows server running that client to take longer to start than Windows's service manager allows. Affected systems log an entry into the System event log: A timeout was reached 30000 milliseconds while waiting for a transaction response (SPL-61193)
  • Generating streaming commands (such as streambag.py) give an Invalid header error on Windows. (SPL-67101)
  • Deployment server initiating a restart after application deployment, and Windows based UF takes longer than Windows allows (30 seconds). SPL-61193
  • Diag does not recover from file I/O errors when copying windows checkpoint files. (SPL-71788)
  • Right clicking on chart and selecting print freezes all versions of IE. (SPL-71276)
  • Search does not auto-finalize on first run when using Google Frame extension on IE. (SPL-70971)
  • Splunk on Windows does not start/restart properly with deployment server, fails with FATAL loader - Timed out waiting for config lock; see splunkd_stderr.log for details. Exiting. (SPL-70075)

Resolved unsorted issues

  • After upgrade from 4.3.x, splunkd.log is reporting a lot of ERROR ProcessDispatchedSearch - PROCESS_SEARCH - Error opening "": No such file or directory. (SPL-63237)
  • After upgrade from 4.3.4 to 5.0.x, splunkd crashes with assertion failure in _writeWithTimeout. (SPL-62009, SPL-73904)
  • splunkd crashes in SummaryDirectorSearchExecutorWorker thread. (SPL-70756)
  • Online fsck doesn't repair corrupted *.data when "./splunk stop -f" + "./splunk restart" (SPL-65914)
  • The root endpoint is not honored in dashboard edit context, redirected to wrong page or 404 when saving. (SPL-64210)
  • Diag does not recover from file I/O errors when copying windows checkpoint files. (SPL-71788)
  • Crash during shutdown: Crashing thread: indexerPipe Registers:. (SPL-71646)
  • splunkd on primary search-head consumes all cpu forcing reboot of the whole system. (SPL-70684)
  • Splunk checks for availability of management port at startup even when disableDefaultPort is set. (SPL-70520)
  • Crashing thread: HTTPRequestHandlerThread. (SPL-69425)
  • Crashing thread on universal forwarder: Exec. (SPL-69283)
  • Crash in search or dispatch thread. (SPL-68356, SPL-68904, SPL-69155)
  • splunkd crashes in UDPInputProc due to race condition. (SPL-68148)
  • SimpleXML forms fail to load if there are no fieldsets. (SPL-63681)
  • Multiprocessing Python scripts do not work on CentOS. (SPL-60550)

This documentation applies to the following versions of Splunk® Enterprise: 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters