Splunk® Enterprise

Release Notes

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Meet Splunk Enterprise 6

Welcome to Splunk Enterprise 6.0!

Read on for information and links into the documentation for all the great new features in this version.

For system requirements information, see the Installation Manual.

Before proceeding, review the Known Issues for this release.

Splunk Enterprise 6.0 was released on Oct. 1, 2013.

Planning to upgrade from an earlier version?

If you plan to upgrade from an earlier version of Splunk Enterprise to version 6.0, be sure to read "About Upgrading to 6.0 - READ THIS FIRST" in the Installation Manual for important things you'll need to know before you upgrade.

New Home screen

Splunk Home is your portal to the apps and data accessible from your Splunk Enterprise instance. The new home screen includes a search bar and panels that provide an overview of and navigation for your apps and data. For more information, see:

Enhanced search experience

This release provides a new interface that brings search and reporting together. We've built in new ways to interact with your data and fields. In addition, we've added the ability to edit reports in the search page, making it easier than ever to create and edit.

The search page redesign brings together a collection of UI changes to improve the usability of the search interface and enable simpler report authoring and editing.

For more information, see:

Data model

Data models drive Splunk Enterprise's Pivot tool. They enable users of Pivot to realize compelling reports and dashboards without first going through the sometimes complex step of designing the searches that generate them. Data models can have other uses as well, especially for application developers.

You can also use the Splunk Enterprise High Performance Analytics Store to accelerate your data models. With an accelerated data model, your pivots, reports, and dashboard panels that use that data model will return results faster, greatly improving the speed of analytical operations over large data sets.

For more information, see:


The new Pivot tool is a drag-and-drop interface that enables non-technical and technical users alike to build complex reports without using the search language. Using Pivot, you can quickly build queries and display results through an easy-to-use interface.

For more information, see:

Native maps

You can now display geographic data and summaries on maps directly within Splunk Enterprise without relying on another app. For more information, see:

Predictive analytics

Using historical data as the baseline, you can use predictive analytics to forecast the future needs of key system resources.

Predictive analytics can be used in a number of ways. For example:

  • It aids in determining future hardware requirements for virtual environments and forecasting energy consumption.
  • It enables enhanced root cause analysis to detect abnormal patterns in events and prevent security attacks.
  • It enables enhanced monitoring of key components to detect system failures and prevent outages before they occur.

For more information, see:

Forwarder management

The forwarder management feature is a Splunk Web interface that provides an easy, visual way to configure the deployment server and monitor the status of deployment updates. Although its primary purpose is to deploy apps and configurations to large groups of forwarders, you can use forwarder management to configure the deployment server for any update purposes, including deploying apps to non-clustered indexers and search heads. For most purposes, the capabilities of forwarder management and the deployment server are identical.

For more information, see:

Simplified cluster management

The main focus of this feature set is to make it easier to configure and operate large-scale clusters. Key improvements include:

For a general introduction to clusters, see:

Simple XML enhancements

The dashboard creation process has been enhanced to enable more powerful views without requiring the use of advanced XML, including improved support for form inputs, token substitution, and more.

For more information, see the following topics in the Visualizations and Dashboards Manual:

Integrated web framework

For custom dashboard creation, this release offers a much more web-developer-friendly method to customize apps and dashboards. We now enable developers to convert dashboards directly to HTML and JavaScript, where they can more easily modify the layout and style, integrate custom JavaScript and more. As part of this feature, we have packaged many of the core dashboard objects and controls into a JavaScript component library that enables developers to use them more readily as they build these custom views. This library is also shared with our new web framework, giving developers full portability to build apps external to Splunk Enterprise, and incorporate many of the elements and controls familiar to Splunk Enterprise customers.

For more information, see "Splunk Web Framework" on the Splunk developer portal.

Windows inputs

This release includes the following new Windows inputs:

In addition, Splunk Enterprise 6 provides additional filtering capabilities as part of event log collection which you can use for more efficient security audit log monitoring. For more information, see "Monitor Windows event log data" in the Getting Data In manual.

Automatic header-based field extraction

For files that have headers that contain field information, such as CSV, this feature enables you to configure Splunk Enterprise to extract these fields automatically during index-time event processing. For more information, see:

License Usage Report View

The new License Usage Report View provides a fast and easy approach to determine the consumption of your Splunk Enterprise license. Directly from the Splunk Licensing page, get immediate insight into your daily Splunk Enterprise indexing volume as well as any license warnings. In addition, get a comprehensive view into the last 30 days of your Splunk license usage with multiple reporting options.

New search commands

This release includes the following new search commands:

  • cofilter returns a count of events that contain the two specified fields.
  • datamodel returns JSON for all or a specified data model and its objects.
  • foreach runs a templated streaming subsearch for each specified field.
  • geostats returns geographical data in summaries that can be rendered on a world map.
  • iplocation extracts location information from IP addresses using 3rd-party databases.
  • pivot enables you to run pivot searches against a particular data model object.
  • tstats performs statistical queries on indexed fields in tsidx files, which could come from normal index data, tscollect data, or accelerated datamodels.

Documentation improvements

The Splunk Enterprise 6.0 release includes two tutorials and several new manuals.

  • The Search Tutorial guides you through adding data, searching your data, saving reports and creating simple dashboards.
  • The Data Model and Pivot Tutorial guides you through adding data, building simple data models, and creating new Pivots.

The new manuals include:

  • Pivot Manual: decribes how to use the Pivot tool and provides tips on how to create useful data visualizations using Pivot.
  • Reporting Manual: covers reports and report management in Splunk Enterprise, including report acceleration, report scheduling, and printing reports as PDFs.
  • Forwarding Data: describes how to use forwarders to get data into Splunk Enterprise.
  • Distributed Search: describes how to use search heads to distribute searches across multiple indexers.
  • Updating Splunk Enterprise Instances: describes how to use deployment server and forwarder management to update Splunk Enterprise distributed instances such as forwarders and indexers.

The Distributed Deployment Manual is now focused on the conceptual background for distributed deployment, an overview of common deployment architectures, information about hardware requirements and capacity planning, and instructions for upgrading a distributed environment.

In addition, the Module System User Manual and the Module System Reference have moved from dev.splunk.com to docs.splunk.com.

Known issues

This documentation applies to the following versions of Splunk® Enterprise: 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters