Splunk® Enterprise

Release Notes

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Known issues

The following are issues and workarounds for this version of Splunk Enterprise.

Refer to the "System requirements" in the Installation Manual for a list of supported platforms and architectures.

For a list of deprecated features and platforms, refer to "Deprecated features" in this manual.

Highlighted issues

  • After upgrading to 6.1 or 6.1.1, scheduled real-time searches (per-result or rolling window) may stop triggering alerts for matching events when two consecutive matching events are more than 1 hour apart. Typically, this is noticed when these searches fail to trigger alert actions such as sending an email. The work-around is to temporarily extend "sessionTimeout" in $SPLUNK_HOME/etc/system/local/server.conf to a value that will be longer than the interval between two matching events, thus preventing the token from expiring:
sessionTimeout = 30d


  • After upgrade to 6.1 and Splunk crashes while reading my disk_objects.log file on Windows platforms. It is triggered by the use of JSON-based indexed field extractions during the acquisition of two native files:

The workaround is to add the following configuration to %SPLUNK_HOME%\etc\system\local\props.conf:



  • After upgrading to 6.1.x, a splunk Splunk real time search filtering optimization is not occurring. Previously, the real time filter would optimize based on index, source, sourcetype or host. The new behavior is that all events must have their terms (keywords) tested against all real time searches, causing indexing slow downs. (SPL-90587)
  • Splunk installs on Windows may encounter the following error while attempting to pick a time frame via the GUI: "Earliest time cannot be greater than latest time" even though the times are correct. The work around is to add "earliest=" and "latest=" to the search instead of using the GUI. (SPL-90600)
  • Splunk installs on AIX fail with a "execve: Permission denied" message. (SPL-84643)

Possible workarounds: 1 - Unconfigure splunk to be managed by the system service management stuff. (splunkd disable boot-start) 2 - Start splunk by running the startsrc yourself as root (by login, sudo, etc) asking it to do the startup work 3 - If you normally run splunk as root anyway, simply log in as root and run splunk start

Upgrade issues

This section lists issues that customers have reported when upgrading from an earlier version of Splunk Enterprise. If you are considering an upgrade, please read "About upgrading to 6.1 READ THIS FIRST" in the Installation Manual.

  • Admin users can't schedule saved searches of users unless the saved searches are shared. To work around this problem:
1. Create a special power/admin user who can run scheduled searches.
2. Assign this user ownership of the scheduled searches .
3. Share the searches at the app level and grant read/write permission to the correct set of users. (SPL-73386)
  • Bundle replication fails when serverName or search head pool GUID has a final segment containing only digits. This can affect users upgrading from pre 6.0.x versions of Splunk. (SPL-73797)
  • Opening saved searches for editing or running CLI searches are very slow. Workaround: disable fetch_remote_search_log in limits.conf. (SPL-75354, SPL-75647)
  • Text field on the top of "dropdown" input is missing. (SPL-83988) Workaround in: http://answers.splunk.com/answers/135011/drop-down-list-using-populating-search-in-61
  • After upgrading to 6.1, all saved reports / alerts fail to send email. (SPL-83956)

Data input issues

  • Persistent queues are not created on Windows for stanzas that contain unusual characters (such as < and >). To work around this issue, specify the persistentQueue explicitly in the input definition. (SPL-74209)
  • Running splunk list wmi doesn't show active WMI collections, but splunk cmd btool wmi list does. (SPL-74028)
  • Hostname override/Regex on path not working correctly for compressed file inputs on Windows. (SPL-73825, SPL-73826)
  • wmi input default fields - with value including newlines doesn't search properly because of \r\n issue. (SPL-34347)
  • Default-index can be set to random index. (SPL-83068)
  • Modular inputs, including perfmon and WinEventLog inputs are not passing the custom metadata fields (_*, _meta or _TCP_ROUTING) (SPL-79421)

Charting, reporting, and visualization issues

  • Pie maps do not have legend labels. (SPL-73569)
  • New reports are not displayed in the report list until you refresh the window. (SPL-73846)
  • When using pivot, stack mode is lost when "Scatter Chart" is selected. - loses stack mode. (SPL-81538)
  • Highcharts set Y-axis value based on first point outside visible range. (SPL-80568)
  • Changing map and tile parameters in the Vizualization Editor creates error in Console. (SPL-79768)

Index replication issues

  • "remove excess-buckets" removes all buckets created under Multi-Site clustering if CM was moved from Multisite to Single Site(SPL-108023)
  • Disabling clustering on a peer node and then attempting to re-enable it later causes hot buckets to be handled incorrectly, with the consequence that the peer cannot be added back into the cluster. This scenario occurs when you take an existing peer node and disable clustering on it (turning it into a standalone indexer), and then you subsequently re-enable clustering to turn it back into a peer on its original cluster. In this situation, any hot buckets that were created on the peer but not rolled when clustering was still enabled, will get rolled after you disable clustering and restart the indexer. At that point, they get marked as standalone buckets, since the indexer is no longer a peer. Those buckets, however, also exist on the remaining cluster as replicated buckets, since they were streamed to other peers while the indexer in question was still a peer. If you then re-enable clustering on the peer and restart it, the bucket conflict causes the peer to fail to register with the master. (SPL-52901)
  • Clustering dashboard displays the removed peer list indefinitely. (SPL-63687)
  • Running splunk remove excess-buckets does not remove excess hot buckets. (SPL-74001)
  • Changing the server name on search head doesn't get reflected in the cluster master's cluster management page. (SPL-72484, SPL-74103)
  • Maintenance mode does not carry over across master restarts. To work around this issue, re-initiate maintenance mode after restarting the master. (SPL-74253)
  • Manually modifying indexes.conf to add a new index stanza and running splunk apply cluster-bundle can cause peer(s) to unexpectedly restart rather than reload (SPL-82152)
  • Unexpected duplicate app: _cluster caused due to password hashing (SPL-82244)
  • Running splunk offline -enforce-counts incorrectly fails to stop the peer and Splunk does not exit. (SPL-73652)
  • When buckets with a truncated journal.gz appear in a cluster, streaming targets are unable to make the bucket searchable when fsck attempts to rebuild the tsidx and other supporting files. (SPL-78797)
  • In clusters, primary copy of bucket is left in weird state with chunk of data not added to journal.gz. This can cause event counts to be off between peers with a common bucket. (SPL-77954)
  • Cluster-config will not work if the parameter value has spaces in them. (SPL-82038)
  • For a multisite cluster, you must roll the peers' hot buckets if you change the values of any of these attributes: site_replication_factor, site_search_factor, or available_sites, and then restart the master. Otherwise, the buckets might not meet the new site_replication_factor or site_search_factor or be fully searchable. You can roll the buckets manually or by issuing a rolling-restart command. (SPL-81972) (SPL-81963)
  • Metasearch does not return correct event count with multisite enabled. (SPL-82868)
  • Cluster master with distributed search disabled still dispatches searches to cluster peers. (SPL-82386)
  • Distributed Peer Monitor thread crashes due to resource unavailable. (SPL-82988)
  • Multisite peer takes approximately six minutes to restart when site configuration is changed. (SPL-81955)
  • Changing your configuration from multi site to non-multisite can result in unsearchable buckets. (SPL-81913)
  • Metadata searches return different results on the search head and the master for the same multisite cluster. To avoid this, run all metadata searches on the master. (SPL-83279)
  • When multisite clustering is enabled and one of the hot buckets is not receiving new data, a metasearch search may not return correct event count. If this happens, the workaround is to roll the set of hot buckets. SPL-82868
  • For clusters, may be unable to open search results output file for search results in a cluster. Workaround is to write to a temp file and rename to the target file. (SPL-81934)
  • Different number of events returned for identical buckets on different sites because partial uncompressed slice exists on one peer's bucket but not on others (SPL-77792)
  • Hot buckets with small event counts may fail to be replicated to other peers in the cluster (SPL-84734)
  • Clustering error "unexpected duplicate app" for apps in both $SPLUNK_HOME/etc/apps and $SPLUNK_HOME/etc/slave-apps. When a lookup or a configuration file is created it goes to the /etc/apps, while the same file may exists in the /etc/slave-apps, causing this warning. (SPL-70433)
  • Clustering error "unexpected duplicate app" for apps in both $SPLUNK_HOME/etc/apps and $SPLUNK_HOME/etc/slave-apps. When a lookup or a configuration file is created it goes to the /etc/apps, while the same file may exists in the /etc/slave-apps, causing this warning. (SPL-70433)

Data model and Pivot issues

  • Due to a validation error, the pivot command no longer accepts certain functions for numeric and string values. This affects any search, report, or dashboard that uses the pivot command. (SPL-83883)
    • Numeric value functions not accepted: first(), last(), earliest(), latest(), dc(), duration(), range().
    • String value functions not accepted: sum(), avg(), max, min(), median(), stdev(), duration(), range(), earliest(), latest()
  • Data model objects that have names starting with an underscore character ("_") do not work correctly and cannot be used in Pivot. (SPL-77054)
  • Indexers/search-head/cluster-masters with a large number of indexes : a large number of SummaryDirector searches are triggered and the instances are becoming unresponsive. Workaround [[1]]. (SPL-76956)
  • Migrating invalid data models from 6.0 to 6.1 fails. (SPL-82164)
  • "Show all lines" does not work in data model editor preview. (SPL-81856)
  • In the Data Model Manager, "Acceleration Status" and "Access Count" fail to update when you click "Update". (SPL-81781)
  • Data Model Pivot, "Legend Position" and "Stack Mode" change to default settings if you change the X/Y-Axis more than once. (SPL-81701)
  • Data Model Pivot: Empty Pivot page displays for Data Model with "_time" field in the Search Object. (SPL-82440)
  • Data Model Pivot: Extra NULL column displays in Pivot with big data and Numbered Attribute in Split Columns. The workaround is to add filter status=*, or make a more refined Data Model that has an object for events with status. (SPL-83686)
  • Datamodel fails to drill down further when the same attribute for Split Rows and Split Columns are selected. (SPL-82238)
  • Data model allows users to upload a JSON file which has Field names with spaces but will not validate it. (SPL-82133)
  • Data Model Manager: Acceleration Status and Access Count fails to update when you click "Update." (SPL-81781)
  • Data model exhibits sticky UI when "transaction group by object" name has a single (x) character. (SPL-81645)
  • Pivot search command fails for an admin trying to pivot on a Private Data Model created by a User. (SPL-82262)
  • In the Data Model Editor, lookup pages open with options displayed for other Lookup when the data model definition is private but the file is app or globally shared. The workaround is to share the definition. For more information, see Add lookup files to Splunk (SPL-80187)
  • In the Data Model Editor, the Edit Lookup page is blank if Lookup is shared only in Lookup Definitions. For more information, see Add lookup files to Splunk. (SPL-80285)
  • In the Data Model Editor, the page to add a Lookup as an attribute is non-functional for scripted lookups. (SPL-84210)
  • In the Data Model Editor, the page to add a Lookup as an attribute is non-functional for lookups referencing empty tables. (SPL-81851)

Integrated PDF generation and PDF Report Server issues

  • Unable to save generated PDFs using Chrome internal PDF viewer. Workaround: Enable Adobe Acrobat or Acrobat Reader as the default PDF viewer in Chrome. For more information, see https://support.google.com/chrome/answer/142056. (SPL-85497)
  • Schedule PDF delivery for email of a dashboard that includes post processing runs as a separate search process and provides 0 results (SPL-82301)
  • Heat maps aren't printed. (SPL-73029)
  • Generating a PDF of scheduled search with quotes in the title results in an error and no search results in the report. (SPL-73798)
  • Not able to export PDF if dashboard has no row or empty row. (SPL-67268)
  • Events format settings like list, table, max lines, wrapping do not apply to PDF reports and are not used. (SPL-67491)
  • If there are unconnected points in an area chart, the chart on dashboard is filled (as an area chart), but the PDF report is only a line. (SPL-58744)
  • PDF Report Server App: Printing PDF on debug/pdf page is broken. (SPL-73938)
  • PDF Report Server App doesn't work with latest Xvfb. Workaround is to install xorg-x11-server-Xvfb.x86_64 0:1.10.6-1.el6.centos. (SPL-66213)
  • Occasionally, some Panels do not render properly in PDF. (SPL-82620)
  • PDF Export result does not display latest unsaved changes to viz report. (SPL-79026)
  • PDF generation does not dispatch job correctly outside of the search app if the global search template includes a macro. (SPL-82464)

Search, saved search, alerting, scheduling, and job management issues

  • If you use | reverse and more than 1000 events are returned in the original search, then click on the bucket in the flashtimeline, no events are shown because all the events after first 1000 events are truncated. (SPL-67642)
  • The times.conf spec file still refers to adding submenus in order to customize time range presets; this feature does not exist in Splunk Enterprise 6.x (SPL-76798)
  • The iconify command fails to render icons in the event viewer. (SPL-79738, SPL-81136)
  • Error "The process cannot access the file because it is being used by another process" in splunkd.log in reference to dispatch search.log. Error does not affect search. (SPL-82288)
  • Eval Function strptime does not return results when 1970 date is used (SPL-83129)
  • In Safari, timestamp is off by one hour around DST changes. (SPL-82359)
  • Error when user tries clone from Settings > User interface > Views. in the HTML dashboard. (SPL-81822)
  • Cloned dashboard is not scheduled but "Schedule PDF Delivery" link indicates that the schedule was cloned. (SPL-79562)
  • Deleting a dashboard with a scheduled PDF does not also delete the scheduled view. (SPL-78612)
  • Paper Size and Layout in PDF Schedule dialog do not respect Paper Size and Layout in Email Settings. (SPL-82517)
  • Search bar is disabled if already selected timerange is selected again. (SPL-82972)
  • In the workflow action, special characters are not escaped properly. (SPL-82566)
  • Username surrounded by dollar signs cannot create saved searches. (SPL-81103)
  • When using search-head pooling, some email alert configurations from the alert_actions.conf are not applied, if they are in an app on the shared storage. Workaround, copy the configuration on the $SPLUNK_HOME/etc/system/local of each search-heads. (SPL-86599)
  • False positive lookup warning in splunkd.log when searching "WARN TransformsExtractionHandler - Unable to find stanza=XXXX.csv in lookups.conf, cannot enumerate fields list".workaround (SPL-82145)
  • Email alert does not fire if the alert title has a reg-ex in it. (SPL-81702

Splunk Web and Home interface issues

  • The indexing status dashboard's Index health graph and Analysis of index bucket do not work for multiple indexes, only a single index. (SPL-34123)
  • Early versions of IE10 on some Windows 8 systems will not load some pages in Splunk Web if Splunk Web is configured to use SSL. To work around this issue, update IE to the latest version or update Windows to at least version 10.0.9200.16521. (SPL-73818)
  • When browsing an Active Directory tree with a depth over 39 nodes, no horizontal scroll bar is shown. (SPL-59980)
  • Chrome browser may not display text on login screen nor dashboard fully. Workaround [[2]]. (SPL-81263)
  • The banner "One or more apps are still being downloaded.." never goes away. (SPL-82258)
  • Admin user can not check other's private alert result.(SPL-82581)
  • Login screen shows expired license on expiration date before it is expires (i.e. same day).
  • Logging in as User with non English characters will make Splunk unusable. Workaround is to remove session files in var/run/splunk and restart SplunkWeb. (SPL-83226)
  • Flashtimeline: 500 Internal Server Error when pasting long URL into panel name. (SPL-80942)
  • A report created and scheduled by admin cannot be embedded by a power user. (SPL-82650)(SPL-81526)
  • Drill down search is broken for scatter charts. (SPL-83052)
  • Too many custom timeranges in the UI, can cause the default ranges to not be displayed in the droplist. (SPL-86219)
  • The URL made for workflow actions does not encode the field values properly. As a result, a field value with special characters in the URL (for example, ampersands) will result in incorrect values being passed. (SPL-92298)

Distributed deployment, forwarder, and deployment server issues

  • Platform Instrumentation is enabled by default on universal forwarders (resulting in introspection data being forwarded by default) and also cannot be disabled through app.conf alone on any other instance type. On systems with many forwarders, this could lead to indexing performance problems. To disable Platform Instrumentation, in the app or local server.conf, set
disabled = true
disabled = true
On non-UFs, you must also set the app's app.conf file
state = disabled


  • The Splunk universal forwarder installer for Solaris 10 does not add the splunk user when you attempt to install it using the pkgadd command. This results in the script generating lots of errors. To work around this issue, create a splunk user on your system before attempting to run the installer. (SPL-74427)
  • Any app that updates its lookup table files can't be pushed out/managed using deployment server. (SPL-35308)
  • Splunk Web becomes unreachable if an enabled deployment server in the same instance cannot access DNS. (SPL-28471)
  • When a large number (>/=100) of users search concurrently on the same search head, some of them may see an error message about an unknown SID, and receive no results. (SPL-71149)
  • SSL compression settings in web.conf fail to disable compression and compression is turned OFF irrespective of useSplunkdClientSSLCompression setting in server.conf. (SPL-64934)
  • Splunk startup script should handle stale PID files gracefully after server crashes. (SPL-36597)
  • Duplicate entries in Forwarder Management for some of the Deployment Clients. (SPL-80215)
  • When you add unsupported attributes to serverclass.conf in Forwarder Management, a blank page is displayed with no error that an unsupported attribute was added. Instead the message displays: FAILED_LOAD_DEPLOYMENT_SERVER. (SPL-82949)
  • Forwarder forwards duplicate data after props.conf is in place for cross platform scenario/when the forwarder is on Solaris and the indexer is on Linux. (SPL-75764)
  • Splunkd preview runs indefinitely on any file preview with "DATETIME_CONFIG=none". (SPL-81637)
  • Running "splunk reload deploy-server" crashes splunkd. (SPL-84299)
  • [splunktcp://<port>] input does not inherit default setting "connection_host = ip" from [splunktcpin] stanza, leads to intermittent forwarder connection timeouts. (SPL-84550/SPL-85899). Issue details and workaround solution: http://answers.splunk.com/answers/142625/event-latency-due-to-intermittent-forwarder-indexer-timed-out-issues
  • When the data from a given search peer changes, the search head adds the new information to the old, retaining any old out-of-date information about licenses in use on the peers. Cases include using a new license master, or changing the licenses on the license master, or changing local licenses on the search peer. This can cause false duplication scenarios and incorrectly disable search on peers. (SPL-81246)

Windows-specific issues

  • Early versions of Internet Explorer (IE) 10 on some Windows 8 systems will not load some pages in Splunk Web if Splunk Web is configured to use SSL. To work around this issue, update IE to the latest version or update Windows to at least version 10.0.9200.16521. (SPL-73818)
  • LDAP authentication does not work on Windows over the IPv6 protocol. (SPL-48342)
  • Splunk on Windows does not create persistent queues for input stanzas that contain unusual characters (such as < and >). To work around this issue, specify the persistentQueue explicitly in the input definition. (SPL-74209)
  • Splunk on Windows does not properly update or save lookup tables when it accesses them with a search. (SPL-40332)
  • The hostname override/regular expression on path does not work correctly for compressed file inputs on Windows. (SPL-73826)
  • If you have the Splunk Add-on for Windows version 4.6.3 and earlier installed on a Splunk 6.x instance, Splunk collects Windows Registry data, even if the Registry monitoring inputs have been disabled by any means. To fix the issue, remove the WinRegMon:// stanza from inputs.conf. (SPL-75116)
  • The Splunk Windows universal forwarder does not forward Windows Event Log or performance monitor data to the correct indexer or forwarder group, as defined by the _TCP_ROUTING attribute in the inputs.conf stanza for the input. Other input types forward data properly. (SPL-79009)
  • Version 6.* of the universal forwarder always installs the Splunk Add-on for Windows (Splunk_TA_Windows), regardless of whether or not you disable the WINEVENT_*installation flags. (SPL-81489)
  • Splunk Enterprise deployment clients on Windows incorrectly capitalize host names. They also truncate host names that are longer than 15 characters. (SPL-82528)
  • The splunk clean all -f CLI command doesn't remove data from the main index on Windows systems. (SPL-82357)
  • The Registry data input incorrectly handles events with different cases in their paths. (SPL-77126)
  • On clustered Splunk Enterprise environments, cluster masters occasionally report "Some Data is Not Searchable" and "Search Factor is Met" simultaneously. Every clustered index meets the search factor in this case, agreeing with the latter of those contradictory messages. (SPL-83693)
  • Splunk Enterprise on Windows ignores the homePath.maxDataSizeMB and coldPath.maxDataSizeMB attributes in indexes.conf. (SPL-78462)
  • Splunk Enterprise on Windows does not show an error message when a user without the edit_license capability tries to add a license through the CLI. (SPL-83365)
  • Excessive search errors found in splunkd.log can affect performance. (SPL-82288)
  • The 32 bit Windows version of the universal forwarder fails to properly upgrade from non-default location. Note: Installing a 32-bit version of any Splunk software on top of 64-bit version is not supported or recommended. (SPL-78984)
  • An issue with Splunk Enterprise 6.1 caused the dashboards and menus in the Splunk App for Windows Infrastructure 1.0.1 update to not render. To fix the problem, download and install version 1.0.2 of the app. (MSAPP-2633)
  • If you create a scripted input and use a full pathname as part of the stanza name (for example, C:\Program Files\Splunk\bin\scripts\getdata.bat, Splunk Enterprise fails to run the script and logs the error Error: Incorrect path to script, even if the script is in the proper directory. To work around the problem, use $SPLUNK_HOME instead of the full pathname. (SPL-82411, SPL-82897)
  • Installation of Windows Universal Forwarder 6.0 or later version under Windows 2003 32-bit, can fail with "Splunk Installer was unable to launch Splunk's First Time Run. Error Code 1" or "Splunk Installer was unable to launch Splunk's Pre Flight Checks. Error Code: -1073741795". Workaround: install earlier Windows UF 5.0.8 (SPL-83043)
  • The Windows Network Monitoring input does not work on 32-bit Windows systems. (SPL-80630)
  • On Windows Server 2012 and Server 2012 R2, an external bug causes the "% Processor_Time" counter to display 100 for multiple processes, even when the number of available CPU cores precludes that possibility. (SPL-80589)
  • WinEventLog (Windows Event Log) with "start_from = newest" attributes in inputs.conf indexes events more than once. This cause duplicated events. Do not use this option. (SPL-90932)

REST, Simple XML, and Advanced XML issues

  • When sending the following XML data as a GET or POST param to a custom splunkd endpoint: <dashboard><foo></dashboard>the endpoint actually receives:<dashboard><foo></dashboard>. (SPL-67453)
  • HiddenPostProcess silently discards input events when the parent search is non-reporting and matches more than 10,000 events. (SPL-64489, SPL-32852)
  • Sorting as "asc" does not work for Dashboard of Panel Type: List. (SPL-65124)
  • In Simple XML, an empty paragraph tag is injected into HTML blocks. (SPL-74031)
  • Creating a new view with the same name as an existing view but with different case (capital letters vs lowercase, etc) silently overwrites the existing view. (SPL-66511)
  • Simple XML: extra pipe in the search post process of a form runs fine on the dashboard but shows errors when linked to the search page. (SPL-74151)
  • The warmToColdScript property not supported by REST API. (SPL-66700)
  • REST /saved/searches App Names With Special Characters Have Invalid Links. (SPL-78179)
  • Dashboard returns 400 error and invalid message if "maxLines" and "count" is empty for Panel Type: Event. (SPL-82233)
  • Resizing a chart in a dashboard will clear the selection. (SPL-82130)
  • Changing form input token within editor does not update URL correctly. Changing "token" name of a form input does not submit correct name to the URL. (SPL-81544)
  • Not able to use "Edit Source" menu from Dashbord list. (SPL-82636)

Web Framework issues

  • If you don't set the "value" property when you first create a TimeRange view, you'll get an error if you try to change "earliest_time" and "latest_time" properties later.

Unsorted issues

  • BlockSignature content validation does not work, and will falsely claim the data has been tampered with if the original source events arrive out of order. (SPL-38082)
  • Splunk does not report server status correctly when there is a problem with SSL/TLS configuration. (SPL-43791)
  • If license slaves are running <6.0 version, they don't have the idx field and in the License Usage view, the split by index field will show a field named UNKNOWN. (SPL-69304)
  • If your license master is down at midnight, it will not generate a rolloverSummary event in license_usage.log, and the license usage report view > Previous 30 days dashboard will have a gap in the data for the previous day. (SPL-73636)
  • The error thrown when your Splunk instance cannot connect to splunkbase/.../checkforupdate is not an ERROR, should be lowered to INFO. (SPL-68010)
  • Can't use the CLI to delete an index with a capital letter in its name. (SPL-72484)
  • You cannot specify a destination folder when installing on OSX. (SPL-74337)
  • Report acceleration Summary folders (summaryHomePath) cannot be created if the homePath of the index is at the root of the filesystem, (homePath=D:\myindex or homePath=/myindex). The workaround is to create the folder manually. (SPL-71645)
  • In server.conf, setting maxThreads or maxSockets in the httpServer stanza to a value of -1 results in an effective value of 0, contrary to what server.conf.spec says (SPL-82389).
  • SSO: Clicking Report Name in Report Acceleration Summaries page will open 404 pageSPL-82702
  • SSO: Acceleration icon fails to display in Searches, Reports, and Alerts pages. (SPL-82699)
  • Datapreview: endpoint doesn't allow for deleting sourcetype properties. (SPL-80918)
  • server.conf In [httpServer] server stanza, maxThreads/maxSockets don't accept negative numbers. (SPL-82389)
  • BucketMover gives error when attempting to freeze. Buckets will attempt to freeze and then show an error "ERROR - BucketMover - sizeBytes=******* candidateBytes=******". Workaround is to delete/move buckets manually (SPL-86189)
  • Licenser pool usage gets reflected only after restarting Splunkd. (SPL-77139)
  • License pool warning at license master keeps coming back after deleting it. The workaround is to delete the warnings on the peers first then the License Manager. (SPL-81810)
  • roleMap's attributes are removed in $SPLUNK_HOME/etc/system/local/authentication.conf by command "splunk reload auth" or restarting Splunk when bindDNpassword is empty. A workaround is to use an app's local directory instead of $SPLUNK_HOME/etc/system/local (SPL-85036)
  • Platform Instrumentation cannot be disabled through app.conf alone on a non-UF. To disable Platform Instrumentation, in the app or local server.conf, set
disabled = true
disabled = true
And also, in the app's app.conf file
state = disabled


  • If a value in a field in a summary index has an "=" (equal) sign in it, applying a stats command will drop the equal sign (SPL-90888)
Last modified on 08 December, 2015
Welcome to Splunk Enterprise 6.1
Splunk Enterprise and anti-virus products

This documentation applies to the following versions of Splunk® Enterprise: 6.1.1

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters