Release Notes

6.3.6

Splunk Enterprise 6.3.6 was released on July 28, 2016.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Data input issues

Date resolved	Issue number	Description
2016-07-25	SPL-113908, SPL-119945, SPL-119946, SPL-119947	Browser becomes unresponsive on clicking a directory in the file explorer window on add data page
2016-07-06	SPL-123264, SPL-122215, SPL-123266, SPL-123268	(Windows Only) Splunk constantly thinks short filenames are new when it doesn't match pattern in a wildcard-monitored directory
2016-07-06	SPL-121758, SPL-120029, SPL-121759	MonitorNoHandle stanza failure to read DNS debug log
2016-05-12	SPL-114449, SPL-120054, SPL-120056, SPL-120057	Unresponsive Script Killing Parameter

Search issues

Date resolved	Issue number	Description
2016-07-18	SPL-97768, SPL-95575	SortProcessor::getStreamingOp crashes in appendpipe subsearch due to inserting streaming operators into report search
2016-06-10	SPL-116867, SPL-122518, SPL-122519	Search Process crashes in dispatch thread when the custom alert condition search contains invalid search query
2016-06-03	SPL-119873, SPL-121958, SPL-121961, SPL-121960, SPL-121963	AdminManager WARNs no capability checks performed in splunkd.log when /apps/local/<APP>/package is accessed
2016-05-31	SPL-120594, SPL-121634, SPL-121635, SPL-121636	Filename of the exported CSV is garbled when the unicode characters are used as filename on internet explorer
2016-05-20	SPL-104480, SPL-118487, SPL-120209	tstats returns discrepancies in the results when compared to the stats command for fields directly injected via _meta

Saved search, alerting, scheduling, and job management issues

Date resolved	Issue number	Description
2016-06-24	SPL-120215, SPL-123434, SPL-123438	Earliest and Latest Tokens not passing through alert link

Distributed search and search head clustering issues

Date resolved	Issue number	Description
2016-07-07	SPL-119757, SPL-122970, SPL-124244, SPL-124245	Artifact replication failing due to origin node trying to replicate itself and causing the original artifact to never reap.
2016-07-06	SPL-115793, SPL-120036, SPL-120037, SPL-120038	Error messaging unclear when there are failures creating replication bundles.
2016-07-05	SPL-80967, SPL-123773, SPL-123774, SPL-123775	Configuration bundles corrupted during creation might be replicated, causing issues in other servers.
2016-06-30	SPL-116897, SPL-123681, SPL-123680	Bundle sizes over 800MB fail
2016-06-30	SPL-123305, SPL-123479, SPL-123375	loadjob not working - statusCode=403, Forbidden
2016-06-13	SPL-120196, SPL-120600, SPL-120601, SPL-121993, SPL-132817	Search Head Cluster Captain becomes unresponsive due to deadlock -causing election to fail.

Universal forwarder issues

Date resolved	Issue number	Description
2016-07-07	SPL-121692, SPL-123278, SPL-123280, SPL-123279, SPL-123281	High CPU Usage On Windows UF caused by large negative system time changes

Distributed deployment, forwarder, deployment server issues

Date resolved	Issue number	Description
2016-07-06	SPL-121815, SPL-118253	forwarder management not working as expected after upgrade

Splunk Web and interface issues

Date resolved	Issue number	Description
2016-07-18	SPL-97768, SPL-95575	SortProcessor::getStreamingOp crashes in appendpipe subsearch due to inserting streaming operators into report search
2016-06-10	SPL-116867, SPL-122518, SPL-122519	Search Process crashes in dispatch thread when the custom alert condition search contains invalid search query
2016-06-03	SPL-119873, SPL-121958, SPL-121961, SPL-121960, SPL-121963	AdminManager WARNs no capability checks performed in splunkd.log when /apps/local/<APP>/package is accessed
2016-05-31	SPL-120594, SPL-121634, SPL-121635, SPL-121636	Filename of the exported CSV is garbled when the unicode characters are used as filename on internet explorer
2016-05-20	SPL-104480, SPL-118487, SPL-120209	tstats returns discrepancies in the results when compared to the stats command for fields directly injected via _meta

Windows-specific issues

Date resolved	Issue number	Description
2016-07-08	SPL-123537, SPL-123933, SPL-123934, SPL-141569, SPL-123931, SPL-123932	Forwarded Windows Security Event Logs don't display correctly
2016-07-08	SPL-122694, SPL-118920	Windows local user added to domain group does not properly translate SID/GUIDs.

Admin and CLI issues

Date resolved	Issue number	Description
2016-06-07	SPL-109382, SPL-121943, SPL-121944, SPL-121945	splunk_httpinput stanza is propogating settings to all input stanzas when viewed in btool
2016-05-19	SPL-120128	Any attempts to run splunk after upgrading from a never started older splunk installation lead to errors and fail

Unsorted issues

Date resolved	Issue number	Description
2016-07-07	SPL-123723, SPL-123630	diag fails when index path directory names are shorter than SPLUNK_HOME
2016-06-09	SPL-121429, SPL-122438, SPL-122439	License related searches need to use source=*license_usage.log* instead of source=*license_usage.log
2016-06-07	SPL-109382, SPL-121943, SPL-121944, SPL-121945	splunk_httpinput stanza is propogating settings to all input stanzas when viewed in btool
2016-06-03	SPL-120176, SPL-121337, SPL-121335, SPL-121336	UF crashes in populate_VolumesIdata when constructing IndexerService object
2016-05-19	SPL-118185, SPL-120528, SPL-120526, SPL-120527	When "useDeploymentServer = 1", HttpInputConf does not properly load tokens into memory

Uncategorized issues

Date resolved	Issue number	Description
2016-07-26	SPL-123262, SPL-123603, SPL-123769	Crashing thread: indexerPipe on failing to write raw data to a hot bucket due to no space on disk
2016-06-22	SPL-117682, SPL-123284, SPL-123285	When a chart containing timerange selection window is refreshed at panel level, user is unable to make timerange selection on the chart after refresh
2016-06-09	SPL-122057, SPL-122425, SPL-122426, SPL-122427	DNS Host Matching failure for IPv6 addresses
2016-06-07	SPL-106900, SPL-122185, SPL-122187	Audit trail spams splunkd.log with errors: "Failed to save seq_no=7885 for host="host::MLTPSAPV224" to disk!"