Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

6.0.2

Splunk 6.0.2 was released on February 24, 2014.

The following issues have been resolved in this release:

Highlighted issues:

Data input issues

  • Splunk shows a Possible typo in stanza... syntax error at startup when you specify an input in the format [splunktcp:9997] and specify compressed = true. This will create a functioning input, but you'll see the error at startup time. To work around this issue, specify the input in the format [splunktcp://9997] instead. (SPL-73654)
  • Hostnames with underscores are not accepted in outputs.conf and deploymentclient.conf (SPL-76795)
  • Splunk can re-read files for IIS, and possibly other files written in a similar manner using headers, resulting in duplicate events. (SPL-77048)
  • Pressing "Enter" after creating a new sourcetype for an input causes Splunk Web to exit the workflow instead of proceeding to the next step in the workflow. (SPL-77006)

Charting, reporting, and visualization issues

  • Timestamps overlap on X axis when resizing the window. (SPL-68007)
  • In the Vizualizations editor, pressing the Enter key to save text input values does not work. (SPL-77199)
  • Warning message "Search query is not fully resolved" occurs in the Dashboard when there is no actual error. (SPL-75612)

Index replication issues

  • If the homepath or coldpath settings for an index in indexes.conf use an environment variable that's invalid on one or more peers, this causes splunk apply cluster-bundle to fail with validation errors. Attempting to rectify this by correcting the environment variables on the peers and restarting the peers can create a situation where the peers are still using the old bundle even though it appears to the master that the bundle has now been pushed successfully. (SPL-73839)
  • If a peer is not up while pushing a bundle, all peers restart. (SPL-75632)
  • A single peer may receive nearly all of the replication buckets so the bucket load is not spread out among the peers. (SPL-79864)

Clustering

  • A manual refresh of the clustering search head manager page is required to show current status after adding or removing a cluster. (SPL-74022)
  • Apply cluster-bundle fails and indexer restarts with no configuration. (SPL-75725)
  • splunk edit master CLI command does not allow the user to specify a new master. (SPL-73732)

Data Model and Pivot Issues

  • Extracted field names containing spaces cause search operations to fail when included in a data model. (SPL-73534)
  • Drill down results may not work properly for chart reports saved in Pivot when _time is used. (SPL-74695)
  • Limits in filters on the Pivot interface have several known issues including no results when you open in search. (SPL-58121)
  • No way to disable temporary acceleration of non-accelerated data models. (SPL-77928)
  • Data Summary table header does not display. (SPL-77034)
  • Setting the limit filter for an object count sometimes does not return correct counts. (SPL-58121)

Search, saved search, alerting, scheduling, and job management issues

  • Intentionsparser drilldown doesn't work for any generating command other than search. (SPL-73358)
  • Drilldown on metadata searches doesn't work and you end up with a broken view. (SPL-74247)
  • A search returning lots of large events with multikv applied can crash the indexer's splunkd process. (SPL-74818)
  • Distributed search head not able to retrieve the index values from indexer in Access Control (SPL-74975)
  • Cannot go back to first page after deleting Alerts in Alert Manager. (SPL-79189)
  • Search heads with many users, apps, and metadata files creates high memory usage. (SPL-79211)
  • When adding data to a summary index using the collect command with commands that create key-value pair (i.e., top, table, stats) Splunk adds an extra escape to special characters: (\) and ("). Splunk does not undo these escapes when a search is run on the summary index, causing a search failure. (SPL-77622)
  • Problems navigating screens and drilling down in tables using the keyboard. (SPL-77478, SPL-76638, 76637, SPL-76625, SPL-76622, SPL-76621, SPL-76611, SPL-76605, SPL-76570, SPL-76554)
  • When a search string starts with an open parenthesis "(", the search defaults to all time. (SPL-77027)
  • Search Job inspector does not provide enough useful information for transaction searches. (SPL-76775)
  • Some Typeahead searches cause indexer to crash. (SPL-76547)
  • Having a very large number of learned sourcetypes can cause forwarder and indexers to use too much memory. (SPL-76448)
  • When adding a view, Splunk does not recognize the XML if you provide it before you provide the View Name. (SPL-76131)
  • remote_searches.log is not sourcetyped. (SPL-76015)
  • In the Search and Report pages, searches using |history do not allow the user to drill down the results properly. (74449)

Distributed deployment, forwarder, and deployment server issues

  • Under certain conditions, installing or upgrading the Splunk universal forwarder on a Windows system can result in that system collecting unwanted data unexpectedly. This issue has been resolved as of 10/8/2013 and an updated universal forwarder installer for Windows has been posted. You can also work around this issue by following the instructions in "Workaround for Windows universal forwarder enabling inputs unexpectedly on installation or upgrade." (SPL-74872, SPL-74907, SPL-74908)
  • Distributed searches fail when they invoke a lookup file that is over 10MB in size. (SPL-74438)
  • The reworked implementation of the deployment server can result in increased maximum deployment times at high client counts (>5k), but with the benefit of lower system resource usage. (SPL-72608)
  • When in streaming mode, events from different clusters are grouped incorrectly due to cluster information being incorrectly reset for each chunk of events. (SPL-78085)
  • In the Forwarder management interface, if the user reassign clients to different groups, these settings go live immediately and Splunk does not confirm before triggering reboots of clients. (SPL-74378)

Windows-specific issues

  • Under certain conditions, installing or upgrading the Splunk universal forwarder on a Windows system can result in that system collecting unwanted data unexpectedly. This issue has been resolved as of 10/8/2013 and an updated universal forwarder installer for Windows has been posted. You can also work around this issue by following the instructions in "Workaround for Windows universal forwarder enabling inputs unexpectedly on installation or upgrade." (SPL-74872, SPL-74907, SPL-74908)
  • Changing visualization options in Splunk Web causes an error message in IE7 and IE8. (SPL-74317)
  • Installing the Windows universal forwarder with the Deployment Server and Indexer fields populated can cause the installation to hang. Leave these fields blank and the installation will complete successfully. (SPL-78756)
  • When you monitor Internet Information Server log files, Splunk indexes some events multiple times. (SPL-77048, SPL-76936)
  • On Window Server 2003, the Splunk Windows universal forwarder is unable to update the checkpoint file. This can cause the UF to reindex inputs when Splunk restarts, resulting in increased license usage. (SPL-78840).
  • tstats command does not respect dispatch time range. Return results for All time (SPL-75890)
  • [Windows] Setting frozenTimePeriodInSecs = 4294967295 is interpreted as frozenTimePeriodInSecs = -1. Setting this value will delete all buckets. (SPL-80218)
  • Missing Dashboard navigation menu in Internet Explorer 7. (SPL-77008)
  • The Universal Forwarder installed for 64-bit Windows does not install properly. (SPL-79215)
  • Adding a new index requires a peer restart rather than reload. (SPL-77605)
  • Universal Forwarder installer run through the CLI fails to install Splunk_TA_Windows application and therefore does not enable data inputs. (SPL-77294)
  • The version of Openssl.exe in the Splunk 6.0 GA Universal Forwarder is not compatible with Windows XP 32-bit. (SPL-76122)
  • Incorrect error message in splunkd.log after installing splunk: "C:\Program Files\Splunk\bin\splunk-netmon.exe splunk-netmon - NetmonConfig::InitNetmonConfig: No valid stanzas found." (SPL-76255)
  • When using the Search app in Internet Explorer 10 or 11, long search strings cause Splunk Web to hang. (SPL-75594)
  • Splunkd does not return the correct time offset value for Caracas timezone. (SPL-42583)
  • In the Vizualizations editor, the x-axis, y-axis and legend tabs do not display correctly in Internet Explorer 7, 8, or 9. (SPL-77028)
  • When stackmode is set to stacked, users are unable to set y-axis scale to log for LINE chart. (SPL-77030)

PDF

  • Scheduled PDF generation does not properly render the alert_actions.conf settings reportPaperSize and reportPaperOrientation. (SPL-73584)
  • Integrated PDF generation does not render non-transforming reports correctly. (SPL-77339)

Hunk

When attempting to use data model on a virtual index, selecting anything other than "All time" returns zero results. (SPL-76851)

Unsorted Issues

  • When passwords are updated in inputs.conf, any hashed version in system/local doesn't get refreshed and the password doesn't work. (SPL-78412)
  • On Linux 6.2+ Splunk should check during install/start time if 'Transparent Huge Pages' is turned ON as it causes indexing degradation and high CPU. Recommendation is to turn THP off. (SPL-76283)
  • Splunk diag etc-filesize-limit file size filter does not work properly. (SPL-76785)
PREVIOUS
6.0.3
  NEXT
6.0.1

This documentation applies to the following versions of Splunk® Enterprise: 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters