Splunk® Enterprise

Release Notes

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


Splunk Enterprise 6.1.4 was released on October 1, 2014.

The following issues have been resolved in this release:

Resolved security issues

  • OpenSSL TLS protocol downgrade attack (SPL-88585).
  • Persistent cross-site scripting (XSS) via Dashboard (SPL-89216).
  • Persistent cross-site scripting (XSS) via Event Parsing (SPL-85579).

For more information, refer to this posting on the Splunk Security Portal.

Highlighted Issues

  • Scheduled real-time searches (per-result or rolling window) may stop triggering alerts for matching events when two consecutive matching events are more than 1 hour apart. (SPL-84357)
  • Real-time searches slow indexing more severely in 6.1.x than 5.x or 6.0.x due to an optimization issue. (SPL-90587)
  • Splunk Enterprise installs on Windows may encounter the following error while attempting to pick a time frame via the GUI: "Earliest time cannot be greater than latest time" even though the times are correct. (SPL-90600)
  • After upgrade to 6.1 Splunk Enterprise crashes while reading my disk_objects.log file on Windows platforms. It is triggered by the use of JSON-based indexed field extractions during the acquisition of two native files:


Upgrade issues

  • On Solaris, search processes crash after upgrade from 6.0.x to 6.1.x. (SPL-85666)

Search issues

  • Cluster search command does not return cluster_count by default. (SPL-86134)

Reporting Issues

  • Report acceleration is not used when a dashboard uses a post-process search. (SPL-88017)
  • HTML dashboards created without a panel give a warning message "This dashboard has no panels." (SPL-88439)

Indexer issues

  • Audit.log does not log when an index is enabled or disabled. (SPL-85085)

Distributed deployment, forwarder, and deployment server issues

  • Platform Instrumentation is enabled by default on universal forwarders (resulting in introspection data being forwarded by default) and also cannot be disabled through app.conf alone on any other instance type. (SPL-83778)
  • Startup script should handle stale PID files gracefully after server crashes. (SPL-36597)
  • Running "splunk reload deploy-server" crashes splunkd. (SPL-84299)
  • The file_tracking_db_threshold_mb parameter in limits.conf cannot be updated using a deployment server, because the file is written to system/local/limits.conf instead of system/default/limits.conf. (SPL-86026) (SPL-86554)

Integrated PDF generation and PDF Report Server issues

  • Generating PDFs of table reports that include a large number of events is slow. (SPL-86958)
  • When scheduling a Dashboard for delivery in PDF format, choosing Landscape layout does not override the default setting. (SPL-89961)
  • PDF generation fails when a search contains %. (SPL-87652)

Splunk Web issues

  • In bar charts with values of 0.1 or less the bar display does not scale automatically. (SPL-85665)
  • Y-axis lables in a bar chart collide with each other when there are more labels than the chart height can accommodate.(SPL-86360)

Input issues

  • With INDEXED_EXTRACTIONS, tailing might ignore the file. (SPL-88387)

Unsorted issues

  • Platform Instrumentation is enabled by default on universal forwarders (resulting in introspection data being forwarded by default) and also cannot be disabled through app.conf alone on any other instance type. (SPL-83778)
  • BucketMover gives error when attempting to freeze. Buckets will attempt to freeze and then show an error "ERROR - BucketMover - sizeBytes=******* candidateBytes=******". (SPL-86189)
  • External/dynamic lookups working path is hardcoded to $SPLUNK_HOME/bin directory. (SPL-87195)
  • Universal forwarder sends many RST packets to indexer when enabling SSL. (SPL-83133)
  • Crashing thread: DispatchReaper -- 'ComponentException: Failed to get LDAP user="" from any configured servers'(SPL-86152)
  • Crashing thread: DispatchReaper -- 'ComponentException': Could not get info for non-existent user="" (SPL-91670)
Last modified on 26 March, 2015

This documentation applies to the following versions of Splunk® Enterprise: 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters