Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

6.0.5

Splunk 6.0.5 was released on July 1, 2014.

The following issues have been resolved in this release:

Highlighted issues

  • Upgrade OpenSSL to 1.0.1h. (SPL-85142)

Upgrade issues

  • The Splunk file-input tracking files, called both "the Fishbucket" and BTree, misbehave when hitting the configured maximum size, or 500MB by default. These files exist at the path $SPLUNK_HOME/var/lib/splunk/fishbucket/splunk_private_db/ and consist of two files named btree_index.dat and btree_records.dat.
    • On windows, when this pair of files hits the ceiling the second (and subsequent times), Splunk will encounter errors in trying to rename them similar to "ERROR BTreeCP - error moving save dir 'D:\Splunk\var\lib\splunk\fishbucket\splunk_private_db\save' to old 'D:\Splunk\var\lib\splunk\fishbucket\splunk_private_db\save.old' while truncating"
    • On UNIX, no logged errors will occur, but significant reindexing can occur.

Input issues

  • Manually modifying indexes.conf to add a new index stanza and running splunk apply cluster-bundle can cause peer(s) to unexpectedly restart rather than reload (SPL-82152)
  • Assertion failure uploading w3c file: CsvLineBreaker::parser::gotEol() -> PipelineData::removeStartOfRaw(), n <= rawSize()' failed. (SPL-83304)
  • Using "TIMESTAMP_FIELDS" may sporadically cause *other* inputs to timestamp incorrectly. (SPL-83163)
  • Scripted input created via REST on a universal forwarder will fail if default index not used. (SPL-83046)
  • Universal Forwarder accumulates sockets in CLOSE_WAIT on port 8089 while taking in data from the /services/receiver/simple REST endpoint (SPL-82649)
  • HEADER_FIELD_DELIMITER and FIELD_DELIMITER do not work as documented when using special character \s. (SPL-81032)

Search, saved search, alerting, scheduling, and job management issues

  • User's private object does not have "delete" option from GUI. (SPL-85630)
  • Reports page doesn't allow user to ctrl+click on a cell to open the search on a new tab. (SPL-84311)
  • HTML dashboard cloning error occurs when attempting to clone from Settings > User interface > Views. (SPL-81822)
  • In the dashboard, using a table type eventsviewer, disabling the line number will remove the line-num header element from the table's html. (SPL-81815)
  • Orphaned acceleration searches process after changing retention time (SPL-81169, SPL-81167)
  • When search.log is too large and rotated to search.log.#, the old search.log.# are not presented on job inspector. (SPL-79638)

Splunk Web issues

  • Status > Server activities > Splunk browser usage and exceptions > Recent browser usage does not show any data. (SPL-77988)

Data model and Pivot issues

  • Limits in filters on the Pivot interface have several known issues including error messages when the stats function is edited in Splunk Web. (SPL-74163)
  • Indexers/search-head/cluster-masters with a large number of indexes : a large number of SummaryDirector searches are triggered and the instances are becoming unresponsive. Workaround [[1]]. (SPL-76956)
  • Pivot table filters limits to 10 results with no scrollbars. (SPL-82530)

Integrated PDF generation and PDF Report Server issues

  • Schedule PDF delivery for email of a dashboard that includes post processing runs as a separate search process and provides 0 results (SPL-82301)

Search, saved search, alerting, scheduling, and job management issues

  • The iconify command fails to render icons in the event viewer. (SPL-79738, SPL-81136)
  • Realtime searches are not successfully cancelled via Splunk Web. (SPL-83708)
  • When using report acceleration, "|top" returns different results between verbose and smart/fast mode. (SPL-83177)
  • "relative_times" eval function does not always return expected results. (SPL-83134)
  • maxresultrows does not restricting the number of search results. (SPL-82568)
  • Upgrade from 4.0.3 to 5.0.3 and now sharepoint is not able to store CSV attachment. (SPL-81629)
  • WARN HttpListener - Socket error from 127.0.0.1 while accessing /services/auth/login: Broken pipe. (SPL-81412)
  • Expand feature for search text area for "Searches and Reports" does not function as expected. (SPL-81607)

Clustering issues

  • Cluster master may show the following warning: Failed to add peer 'guid=<guid> server name=<server> ip=<ip>:<port>' to the master. Error=non-zero pending job count=<count>. (SPL-83438)
  • splunk show cluster-bundle-status command shows the new active bundle ID before rolling restart is complete. (SPL-73665)
  • splunk apply cluster-bundle command gives no clear indication that the bundle was not pushed. (SPL-75585)

Alerting issues

  • If saved search contains the transpose command, alert is triggered even when search returns 0 events. (SPL-80698)

Distributed deployment, forwarder, and deployment server issues

  • Deployment Clients on Windows incorrectly truncate long hostnames, as well as uppercase the name; this is a regression from Splunk 5.x (SPL-82528)
  • Deployment Server shows the first existent server class after clicking new server class. (SPL-83710)
  • Reloading a deployment server causes deployment server to recompute bundles of unmodified apps, resulting in *all* deployment clients re-downloading *all* apps. (SPL-83491)
  • Upon restart after upgrade, deployment server may complain about server classes that don't exactly match illegal server class names. (SPL-83340)
  • For the Deployment Server, serverclass.conf does not honour whitelist at app level. (SPL-82483)
  • Downloads of knowledge bundles from search heads to search peers could result in bundle corruption on the peers due to timeouts. (SPL-82334)

PDF Generation issues

  • PDF generation ignores display.general.type = statistics and always shows a graph. (SPL-83077)
  • Charts appeared to be truncated when exported to PDF. (SPL-82805)
  • Scheduled PDF delivery of a dashboard that includes post processing runs as a separate search process. (SPL-82301)
  • Email PDF delivery for dashboards only successful when performed by user with admin role. (SPL-82230)

Windows-specific issues

  • ADmon: Timestamp fields (pwdLastSet, badPasswordTime, lastlogonTimestamp, etc.) are not being retrieved accurately from the AD record starting release 6.0. (SPL-83047)
  • Active Directory Monitor is copied again from admon.conf after its deletion. (SPL-82523)
  • Long events are not properly wrapped in IE9. (SPL-82418)
  • WinEventLog in Windows 2008 unable to collect print logs. (SPL-82364)
  • Error message appears in Windows event viewer's Application log after Splunk is installed. (SPL-80558)
  • Windows modular data inputs have inconsistency in the exit codes causing false alarms in Splunk App for Enterprise Security. (SPL-77659)

Unsorted issues

  • In server.conf, setting maxThreads or maxSockets in the httpServer stanza to a value of -1 results in an effective value of 0, contrary to what server.conf.spec says. (SPL-82389)
  • root_endpoint edits not saved in dashboard. (SPL-83886)
  • Access control roles page does not include virtual indexes in list of available indexes. (SPL-83497)
  • server.conf attributes maxThreads/maxSockets don't accept negative numbers. (SPL-82389)
  • License Manager may hit a scalability ceiling. (SPL-81863)
  • "splunk help diag" doesn't mention the new component-level controls such as "--collect", "--enable" or "--disable". (SPL-81254)
  • Distributed Peer Manager's Search peer tracking does not drop old license hash info when receiving new information from search peers (for example, when they change license masters or local license keys). (SPL-81246)
  • Tailing processor intermittently stops reading batch files, no log message is created. (SPL-80754)
  • Using the linux standard logrotate with copytruncate can trigger a race condition in batch reader that leads to the file being ignored until restart. (SPL-76980)
  • TCP output stalls inside unnecessary condition variable. (SPL-80196)
PREVIOUS
6.0.6
  NEXT
6.0.4

This documentation applies to the following versions of Splunk® Enterprise: 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters