Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


Splunk Enterprise 6.1.3 was released on August 4, 2014.

The following issues have been resolved in this release:

Upgrade issues

  • Permission issue for $SPLUNK_HOME. (SPL-84372)
  • After upgrading to 6.1, all saved reports / alerts fail to send email. (SPL-83956)

Search issues

  • splunkd.exe Memory leak in monitoring. (SPL-84715)
  • Search heads request truncated replicated bundle listing from indexers, causing problems if a bundle >30 entries in the past is needed. (SPL-86760)
  • Splunk autoKV experiences difficulties handling user data with leading/trailing whitespace in fields. (SPL-79644) (SPL-85791)
  • Private objects do not have delete option in Splunk Web. (SPL-85630)
  • Failure to open search head pool configuration file during copyAppUpdatesToSharedStorage results in nonsense exception / migration&install failure. (SPL-84880) (SPL-82521)
  • In datapreview, JSON Index Time Field Extraction produces no events when TRUNCATE is set to 0. (SPL-83690)
  • Error when user tries clone from Settings > User interface > Views. in the HTML dashboard. (SPL-81822)
  • Crash in JSON parsing thread when using JSON data preview. (SPL-83679)
  • splunkd crashes intermittently in Bundle replication worker thread. (SPL-83952)
  • The "rest" search operator doesn't return any results when scoped to a fired alert endpoint. (SPL-83405)
  • Error "The process cannot access the file because it is being used by another process" in splunkd.log in reference to dispatch search.log. Error does not affect search. (SPL-82288)(SPL-84457)
  • splunk-optimize.exe crashes in "tsidx_optimize_n+0x492 [c:\splunk\build-src\current\src\searchthing\tsidx.c @ 2855]". (SPL-84446)
  • Local-File-Inclusion with Path Traversal Vulnerability. (SPL-84469)
  • If saved search contains the transpose command, an alert is triggered even when search returns 0 event. (SPL-82864)
  • The search drilldown changes search condition may not work with inline calculated fields. (SPL-86150)
  • Intermittent 'File not found’ browser error when trying to export very large result set (eg. 700K) to .csv file. (SPL-86096)
  • relative_times eval function does not return expected results. (SPL-86806)

Alerting issues

  • Can not delete triggered alerts from triggered alert page. (SPL-84239)

Data Model and Pivot Issues

  • Data Model acceleration data creation occurs less promptly than desired. (SPL-84730)
  • Indexers/search-head/cluster-masters with a large number of indexes : a large number of SummaryDirector searches are triggered and the instances are becoming unresponsive. Workaround [[1]]. (SPL-76956)

Index replication issues

  • Hot buckets with small event counts may fail to be replicated to other peers in the cluster (SPL-84734)
  • Manually modifying indexes.conf to add a new index stanza and running splunk apply cluster-bundle can cause peer(s) to unexpectedly restart rather than reload (SPL-82152)

Clustering issues

  • Peer holds on to mutex when downloading a large bundle causing heartbeat timeout. (SPL-84903)
  • Peer fails on move bundle to peer apps error: failed to rename (Invalid cross-device link). (SPL-85025)
  • AckQ causes permanent data stall when a single pData is larger than entire AckQ size. (SPL-82109)(SPL-84882)
  • If peers don't return bundle status due to download/network issues, but re-add themselves, the master is stuck infinitely on a bundle push.
  • Manually modifying indexes.conf to add a new index stanza and running splunk apply cluster-bundle can cause peer(s) to unexpectedly restart rather than reload (SPL-82152)(SPL-84888)
  • Distributed peer manager search peer tracking does not drop old license hash info when receiving new information from search peers (such as when they change license masters or local license keys). (SPL-81246)
  • Unable to grab diag after cleaning index. (SPL-85788)
  • Cluster Peer missing pass4SymmKey has no error/warn after adding a session key in CM. (SPL-82685)

Deployment server issues

  • Splunk Enterprise deployment clients on Windows incorrectly capitalize host names. They also truncate host names that are longer than 15 characters. (SPL-82528)(84879)
  • "splunk reload deploy-server" causes deployment server to recompute bundles of unmodified apps, resulting in *all* deployment clients re-downloading *all* apps. (SPL-86804)

Integrated PDF generation and PDF Report Server issues

  • Schedule PDF delivery for email of a dashboard that includes post processing runs as a separate search process and provides 0 results (SPL-82301)

Forwarding issues

  • New crash "Crashing thread: structuredparsing" may occur on UF. (SPL-86141)

Splunk Web issues

  • js/views/shared/eventsviewer/shared/workflowActions.js does not work with some attributes. (SPL-85525)
  • A report created and scheduled by admin cannot be embedded by a power user. (SPL-82650)(SPL-81526)
  • Socket error from while accessing /services/auth/login: Winsock error 10053 causes Splunk Web to be unavailable. (SPL-85334)
  • eventstats makes search unordered and then Python ResultSet class times out. (SPL-85335)
  • Power user can delete read-only reports. (SPL-85185)(SPL-84189)
  • When auto-pause time becomes 0, search does not pause. (SPL-84197)

Input issues

  • splunktcp://<port> input does not inherit default setting "connection_host = ip" from [splunktcpin] stanza, leads to intermittent forwarder connection timeouts. (SPL-85899)

Windows issues

  • ADmon: Timestamp fields (pwdLastSet, badPasswordTime, lastlogonTimestamp, etc.) are not retrieved accurately from the AD record. (SPL-84878)
  • Error message in windows event viewer's Application log after installing splunk. (SPL-83455)
  • On Windows 2003 Server 32bit, upgrade from 6.0.1 universal forwarder to 6.0.4 universal forwarder, events are not sent to indexer after migration. (SPL-84121)
  • WinEventMon::processLogChannel: Failed to checkpoint for channel='security'. (SPL-84181)

Licensing issues

  • License Manager peers lack configurable heartbeat period. (SPL-81863)
  • License Manager appears to be hitting a scalability ceiling. (SPL-84876)
  • With universal forwarder on Windows, excessive RAM usage when processing events with useAck = true. (SPL-86897)
  • When the data from a given search peer changes, the search head adds the new information to the old, retaining any old out-of-date information about licenses in use on the peers. Cases include using a new license master, or changing the licenses on the license master, or changing local licenses on the search peer. This can cause false duplication scenarios and incorrectly disable search on peers. (SPL-81246)

Unsorted issues

  • TCP output stalls inside unnecessary condition variable. (SPL-80196)
  • splunk reload deploy-server -class is not supported in 6.0 but works in 5.0.x.(SPL-85118)
  • Multi-line JSON does not render properly. (SPL-85528)
  • Simple XML: Dashboard fails when popSearch for dropdown returns no results. (SPL-85314)
  • conf-mutator.pid lacks cleanup strategy for crashes with PID-collision. (SPL-85226)
  • For RPM, deb, and solaris pkg installation, when using non-passwd file based users, Splunk installer doesn't set the owner of the folder for the Splunk user. (SPL-85193)
  • PendingDiscard state does not reset the Searchable state at CMBucket level (SPL-85055)
  • ERROR DispatchThread - Error reading runtime settings: File does not exist. (SPL-86829)
  • Misleading error message applying cluster-bundle while login failed. (SPL-86812)
  • When SSL is Disabled: Deployment Clients 5.0.X or upgraded to 6.0.1 are unable to establish communication with DS - appears to still be attempting SSL Communication. SPL-83098
  • cron validator in the wizard fails to recognize valid cron. (SPL-85234)
  • In server.conf, setting maxThreads or maxSockets in the httpServer stanza to a value of -1 results in an effective value of 0, contrary to what server.conf.spec says (SPL-82389).
  • Splunkd generates warning msgs incorrectly during shutdown. (SPL-84610)

This documentation applies to the following versions of Splunk® Enterprise: 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters