Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


Splunk Enterprise 6.2.6 was released on September 14, 2015.

The following issues have been resolved in this release:

Security issues

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Data input issues

Publication date Defect number 'Description
2015-9-9 SPL-102557 In Splunk Web, Add Data hangs at "Uploading File 100%" when upload fails.
2015-9-9 SPL-96663 "Getting Data In" file directory browser breaks when running behind Apache proxy.
2015-9-9 SPL-100036 The "Getting Data In" Index drop down displays default index even if there is no write access available.

Indexers and indexer clustering issues

Publication date Defect number Description
2015-9-9 SPL-103251 Buckets with corrupted journal.gz files are stuck in a PendingDiscard state with continuous fsck retries. (Clone: SPL-78797)
2015-9-9 SPL-103464 Buckets with invalid timebounds cause cluster peer to crash.
2015-9-9 SPL-99116 When instances of an indexer cluster go down and come back up, cluster peers are removed from distributed search groups and must be re-added manually. (Clone: SPL-95114)
2015-9-9 SPL-102940 Assertion raised by archivereader thread while indexing tar log files.
2015-9-9 SPL-98866 Lookup files for *NIX App is not replicated within a search head cluster.
2015-9-9 SPL-99018 Saved search artifacts not available to all search head cluster peers via loadJobs/bringJobs. (Clone: SPL-91780)

Integrated PDF generation and PDF Report Server issues

Publication date Defect number Description
2015-9-9 SPL-104867 Schedule PDF Generation fails when the xml encoding does not match the content encoding.
2015-9-9 SPL-100294 PDF delivery fails for some scheduled searches.

Search, saved search, alerting, scheduling, and job management issues

Publication date Defect number Description
2015-9-9 SPL-102642 Summarization endpoint times out consistently due to scheduled search load causing HttpListener - Socket errors.
2015-9-9 SPL-103312 Error: Invalid latest_time: latest_time must be after earliest_time. (Clones: SPL-98045)
2015-9-9 SPL-103448 OUTPUTNEW is destructive under certain conditions. (Clone: SPL-103427)
2015-9-9 SPL-103527 The fields command cannot remove row* fields created by transpose command.
2015-9-9 SPL-102836 tonumber command returns null when padding exists in string.
2015-9-9 SPL-103416 Saved search with -email parameter creates the typo with action.emai (missing the 'L') in savedsearches.conf.
2015-9-9 SPL-103419 Indexed lookup returns NULL result when the lookup table has a large number of duplicate rows.
2015-9-9 SPL-100434 Updating an Alert via Actions dialog disables summary indexing, RSS, lookup population.
2015-9-9 SPL-103959 Device or resource busy; 38 threads active, in OutputProc_hnav_big_data.
2015-9-9 SPL-104427 Role is automatically mapped back to user and LDAP group even after the role is deleted then re-introduced. (Clone: SPL-103277)

Splunk Web and Home interface issues

Publication date Defect number Description
2015-9-9 SPL-102452 When any field except the first one is used as an overlay field with view as axis setting, the second y-axis fails to render.
2015-9-9 SPL-103168 Cursor jumps to end of line when user types anywhere inside the login form input fields.
2015-9-9 SPL-102321 When an event row is expanded in dashboard's eventsviewer for a postprocess search, event detail is changed.
2015-9-9 SPL-104447 Session Timeout not Respected on SSO.
2015-04-15 SPL-99702 In Data Inputs > Forwarded Inputs drilling down to any of the listed entries will display truncated/incomplete Server Class name.
2015-04-20 SPL-99959 In Data Inputs > Forwarded Inputs drilling down to any of the listed entries will display an incorrect number of input entry results

Distributed deployment, forwarder, and deployment server issues

Publication date Defect number Description
2015-9-9 SPL-104626 outputs.conf comments are stripped from file when encrypting SSL password.
2015-9-9 SPL-100887 10K+/sec forwarder connections cause deployment server to become unresponsive.

Distributed search and search head clustering issues

Publication date Defect number Description
2015-9-9 SPL-101734 Search head with Enterprise Security App 3.3.0 crashes at thread: TcpChannelThread.
2015-9-9 SPL-93770 Deployer should specify count=-1 when fetching /member/members. (Clones: SPL-93107)
2015-9-9 SPL-103537 Running "splunk apply shcluster-bundle" command causes loss of custom apps from all search head cluster members.
2015-9-9 SPL-103799 Assertion raised on universal forwarder by TcpOutEloop thread in TcpOutputGroup::unregisterChannel() method.
2015-9-9 SPL-102360 In search head clusters, HTTP request failure may cause multiple warning messages.
2015-9-9 SPL-104903 Uneven search delegation when there are lots of scheduled searches. (Clones: SPL-96718)
2015-9-9 SPL-104673 Search head crashed after receiving fatal signal 6 (Aborted).
2015-9-9 SPL-104231 Captain always restarts itself upon app deploy, even if no apps were changed. (Clone: SPL-92157)

Windows-specific issues

Publication date Defect number Description
2015-9-9 SPL-102149 Public/private key file loading failures cause DM acceleration searches to fail (and fill up dispatch).
2015-9-9 SPL-102543 ERROR LookupOperator - Error in 'lookup' command: The lookup table 'correlationsearches_lookup' does not exist.
2015-9-9 SPL-103148 Automatic Internet Explorer refresh makes it impossible to view the "values" pop-up for some fields.
2015-9-9 SPL-100643 Data Model Acceleration fails to run due to inaccessible distributed search keyfiles.
2015-9-9 SPL-101716 Whitelist values ignored when configured in multiple whitelists
2015-9-9 SPL-94305 Windows Security Event Logs are missing when there is a burst of events.

Unsorted issues

Publication date Defect number Description
2015-10-6 SPL-103932 During shutdown the follow thread may crash: IdataDO_Collector in _ZN12HashedStrMapIPK8TimezoneE14_internal_findEPKcmm
2015-9-9 SPL-102111 kvstore lookup fails with case insensitive matching.
2015-9-9 SPL-102384 LDAP strategy may show wrong association.
2015-9-9 SPL-103546 Same regex may behave differently between rex command and props.conf.
2015-9-9 SPL-101712 Splunkd S2S does not support diffie-hellman ciphers
2015-9-9 SPL-103088 Scheduled Real time (All time) search performance degradation post 6.2.1 upgrade. (Clone: SPL-95439)
2015-9-9 SPL-101055 addData pages display English instead of localized text.
2015-9-9 SPL-99553 In the DMC, hitting the "Apply" button can modify default search behavior in dramatic ways without warning the user.
2015-9-9 SPL-97319 In Chrome, the Time field in time picker sizes incorrectly.
2015-9-9 SPL-83461 Universal forwarders receive ACKs out of order, causing huge memory growth.
2015-9-9 SPL-103849 Datamodel acceleration status needs to show the correct percentage
2015-9-9 SPL-103919 HttpClientRequest.cpp:1887: virtual void HttpClientConnection::errorHappened(const SocketError&): Assertion `_trans->_connp == this' failed.
2015-9-9 SPL-103293 support for https protocol when using googlemapview lib.
2015-9-9 SPL-103335 Site minder proxy using unsupported “Content-type” case in XHR response headers cause GET requests to have undefined job id.
2015-9-9 SPL-103938 Inconsistency between UI's display and config's content when enabling or disabling TCP input. (Clone: SPL-101045)
2015-9-9 SPL-104514 In limits.conf the default value of max_count should be 500000 in limits.conf.spec (Clones: SPL-104440, SPL-104512, SPL-104513)

This documentation applies to the following versions of Splunk® Enterprise: 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters