Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


Resolved issues

Splunk Enterprise 6.2.3 was released on April 30, 2015.

The following issues have been resolved in this release:

Security issues

Publication date Defect number Description
2015-5-1 SPL-95798 Secure flag inconsistently set for session cookies when appServerPorts!=0
2015-5-1 SPL-98351 Multiple vulnerabilities in OpenSSL prior to 1.0.1m (Clones: SPL-98356, SPL-98352)
2015-5-1 SPL-95270 Secure flag not set for cval, uid, csrf cookies on the login page when running Splunk in legacy mode (appServerPorts=0).
2015-5-1 SPL-95594 Cross-site scripting in Search. (Clone: SPL-97822)
2015-5-1 SPL-96280 Disable SSLv3 in KV Store Replication.
2015-5-1 SPL-93516 Cross-site scripting in management and configuration.

Highlighted issues

Publication date Defect number Description
2015-03-17 SPL-96265 Orphan KVStore process stops Splunk from restarting.
2015-04-23 SPL-100103 KV store collections are purged when owning app is disabled
2015-5-1 SPL-94017 mongod creates up to 65k files in /dev/shm/, using up to 500MB of space

Data input issues

Publication date Defect number Description
2015-5-1 SPL-98155 Duplicate events when monitoring gzip files on NFS server with Clock skew Clone: SPL-96292
2015-5-1 SPL-97132 archivereader thread crashes when reading csv.gz files.

Charting, reporting, and visualization issues

Publication date Defect number Description
2015-5-1 SPL-97255 Summary Status in Report Acceleration Summaries page does not update from Pending (Clone: SPL-87068)
2015-5-1 SPL-97427 Map graph is empty when using lower boundary limits for binspanlat and binspanlong in the geostats map command. (Clone: SPL-91723)
2015-5-1 SPL-95571 Home menus disappear once a home dashboard is refreshed.

Indexers and indexer clustering issues

Publication date Defect number Description
2015-5-1 SPL-93244 ERROR message in Tailing Processor: "Bug: tried to check/configure STData processing but have no pending metadata".
2015-5-1 SPL-97654 Internal Splunkd Log message displays in SplunkWeb when Splunk fails to discard Search artifacts on peer.
2015-5-1 SPL-98007 Clicking "remove" button in the cluster management excess buckets page deletes all standalone buckets.

Data model and Pivot issues

Publication date Defect number Description
2015-5-1 SPL-97524 When a user clicks the update link within acceleration information we should provide user feedback once the data is updated. (Clones SPL-95099)
2015-5-1 SPL-95808 Data Models page does not display acceleration information when the datamodel name is a substring of app name.

Search, saved search, alerting, scheduling, and job management issues

Publication date Defect number Description
2015-5-1 SPL-97264 404 error message when editing the email action of a ES app correlation search via Manager (Settings >> searches, Reports and Alerts).
2015-5-1 SPL-97298 Token replacement fails in email alerts when raw data contains binary character. (Clones SPL-96721)
2015-5-1 SPL-94296 Triggered Alerts only kept 7 days upon restart regardless of user configurations. (clone: SPL-93331)
2015-5-1 SPL-96790 Search results table fails to display field named latest_time or earliest_time correctly.
2015-5-1 SPL-97661 PCRE Heap Overflow issues for PCRE versions less than 8.36
2015-5-1 SPL-97079 Excessive time is spent in dispatch.createProviderQueue when search includes splunk_server specification as opposed to searching all peers. (Clone: SPL-94054)
2015-5-1 SPL-98807 Searches block on search head because of splunkd timeout on /receivers/bundle REST endpoint when replicating bundle to slow peer. (Clone: SPL-98547)
2015-5-1 SPL-95428 spath processor, due to malformed XML input.
2015-5-1 SPL-97601 Bundle Replication: Skewed modtimes on temporary bundle files cause premature reaping and errors in distributed search.
2015-5-1 SPL-96622 search does not work with combination of NOT and "date_hour < 24 AND date_hour >0"".
2015-5-1 SPL-96849 Search "index=_* AND index!=main" returns no results.
2015-5-1 SPL-97020 SearchParser returns error when using savedsearch to call macro with line feed. Clone: SPL-92827
2015-5-1 SPL-96865 When system-wide search limits are reached, realtime searches are skipped with no user notification. (Clone: SPL-87805)
2015-5-1 SPL-97309 stats count by eventtype(or tag)" to return no results. (Clone: SPL-85091)
2015-5-1 SPL-97372 Netapp Dashboard takes too long to generate graphs, consumes a lot of memory. (Clone: SPL-95086)
2015-5-1 SPL-97419 "Calculated" field should not expand when preceded immediately by a NOT Operator or inside a NOT Expression. (Clone: SPL-93523)
2015-5-1 SPL-96334 loadjob on savedsearch with no results shows error instead of "no results" message. (Clone: SPL-93526)

Splunk Web and Home interface issues

Publication date Defect number Description
2015-5-1 SPL-97154 Incomplete exported csv when field value has double-byte white space at the end. (Clone: SPL-91706)
2015-5-1 SPL-95194 Simple XML Dashboard - report's permission operation from edit panel mode causes change in chart type. (Clone: SPL-94969)
2015-5-1 SPL-95560 Mako template fails to render error when splunk is restarted. (Clone: SPL-92223)
2015-5-1 SPL-95603 Autofill of user credentials causes login failure on Safari, Firefox and Internet Explorer.
2015-5-1 SPL-97589 In a combination of map and sendemail, when a field has a space the substring after the space is not recognized. (Clone: SPL-93240)
2015-5-1 SPL-98540 "Explore Data" link in settings tab returns a 404 page.
2015-5-1 SPL-92298 Workflow action event menu does not encode _raw field when used in link.uri.
2015-5-1 SPL-93746 Workflow Actions field menu does not URI encode special tokens when used in link.uri.
2015-5-1 SPL-96057 Workflow action does not honor $!token$ and will always encode the link.uri
2015-5-1 SPL-96068 SSO timeout presents a misleading message to the end user - "Reconnecting to Splunk server"
2015-5-1 SPL-96243 When typing a password spaces are deleted. (Clone: SPL-95847)

Distributed deployment, forwarder issues

Publication date Defect number Description
2015-5-1 SPL-92713 The "Edit Instance Info" and "Edit Server Roles" pop-ups in the Management Console setup do not show the selected instance's serverName (clone: SPL-92712)

Deployment Server issues

Publication date Defect number Description
2015-5-1 SPL-96407 If user deletes items out of order and seta whitelist to * , the Edit Clients option fails in the Deployment Server.
2015-5-1 SPL-98561 If you reload the deployment server with an out-of-sequence whitelist and blacklist, TcpChannelThread crashes.
2015-5-1 SPL-84687 If you add multiple entries to whitelist in non-consecutive order, deployment server cannot find whitelist.

Distributed search and search head clustering issues

Publication date Defect number Description
2015-5-1 SPL-95885 Search head cluster member crashes with SEGFAULT intermittently when alerts are run too fast
2015-5-1 SPL-99022 [DSPROXY] Prevent clobbering of default lookup table files when issuing "splunk apply shcluster-bundle". (Clone: SPL-84485)
2015-5-1 SPL-96866 Search Head Clustering - Crash in DispatchReaper thread during heavy scheduler activity. (Clone: SPL-95746)
2015-5-1 SPL-99027 Time To Live (TTL) is set to 0 (expired) for jobs executed by cluster member in saved/searches/<searchname>/history REST endpoint. (Clone: SPL-98740)

Windows-specific issues

Publication date Defect number Description
2015-5-1 SPL-95834 [Deployment Server] reload deploy-server breaks when %HOMESHARE% declared and %HOMEPATH% starts with '\'
2015-5-1 SPL-96835 On the Edit Clients page in forwarder management, the values inside the text area disappear when clicked upon.
2015-5-1 SPL-95121 Splunk 6.2 installer fails if msi database on the machine is partially corrupted
2015-5-1 SPL-96431 The login form does not appear when user that is not already logged in accesses the bookmarked login link.
2015-5-1 SPL-95995 Windows Heavy forwarder crash in EventLoop::checkWaitSet when WSAEFAULT error is returned by the OS during Network read operations. (Clone: SPL-94156)
2015-5-1 SPL-97735 During Indexing Splunk shows impossibly large number of Windows events.
2015-5-1 SPL-95638 Universal Forwarder 6.2.0 does not enable Windows event logs by default.
2015-5-1 SPL-95004 Large delays in Windows Event Logs due to low network thruput caused by ~250ms pause after tcp sends 6-7 packets.
2015-5-1 SPL-96852 WinEventLogChannel should report system error when failed to subscribe to a channel. (Clone: SPL-96831)

REST, Simple XML, and Advanced XML issues

Publication date Defect number Description
2015-5-1 SPL-93954 Iframe module does not display scrollbars when Iframe height is fixed pixels.
2015-5-1 SPL-95778 No results in pie chart drilldown when "charting.chart.showPercent" set to true in SimpleXML. (clone: SPL-94314)

Web Framework issues

Publication date Defect number Description
2015-5-1 SPL-96165 Indexers crashed repeatedly in tcp channel with assertion failure assert(!_data.hasWriteData()). (Clone: SPL-95193)

Unsorted issues

Publication date Defect number Description
2015-5-1 SPL-85036 roleMap attributes are removed in $SPLUNK_HOME/etc/system/local/authentication.conf when user reloads auth (splunk reload auth) or restarts Splunk.
2015-5-1 SPL-97089 Search filter does not work properly when a user has a role with search restriction and inherits another role which also has search restrictions.
2015-5-1 SPL-97644 SummarizationDirector exceptions during search in Splunkd process causes crashes. (clone: SPL-92820)
2015-5-1 SPL-94066 Unable to save summary searches when a summary index is created in search peer. (Clone: SPL-91999)
2015-5-1 SPL-95840 Improve logging - Unclear "StringPool - SuppressionKey" warnings at search head restart. (Clone: SPL-95574)
2015-5-1 SPL-96262 splunkd.log contains unhelpful warning message "HTTPAuthManager - Nonce collision -- nonce: a5d6a32a95097797e195751accc2d428, peer: xxxx". (Clone: SPL-89162)
2015-5-1 SPL-94977 Host and servername in conf files not populated after removal using clone-prep-clear-config command.
2015-5-1 SPL-97752 Scripted input with high interval does not start on ubuntu. (Clone: SPL-84358)
2015-5-1 SPL-92617 splunkd instrument-resource-usage mis-identifies remote scheduled searches as historical searches. (Clone: SPL-91273)
2015-5-1 SPL-93569 Introspection resource_usage.log missing data.search_props fields. (Clone: SPL-97775)
2015-5-1 SPL-97684 tstats in subsearches returns no results in search head clustering environment due to incorrect datamodel summary path.

This documentation applies to the following versions of Splunk® Enterprise: 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters