6.3.1
Splunk Enterprise 6.3.1 was released on November 4, 2015.
The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.
Upgrade issues
This section lists issues that customers have reported when upgrading from an earlier version of Splunk Enterprise. If you are considering an upgrade, please read "How to upgrade Splunk Enterprise" in the Installation Manual.
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-107253 |
After upgrade searches fail due to vector::_M_range_check exception because of Malformed lookup CSV files.
|
Distributed deployment, forwarder, and deployment server issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-102412, SPL-83461 |
UFs receive ACKs out of order causing huge memory growth.
|
2015-11-04 |
SPL-103257, SPL-100887 |
20k+/hr forwarder connections cause deployment server to become unresponsive
|
2015-11-04 |
SPL-104953, SPL-99702 |
UI: Data Inputs > Forwarded Inputs serverclass name is truncated / incomplete
|
2015-11-04 |
SPL-104976, SPL-104626 |
outputs.conf comments are stripped from file when encrypting SSL password
|
2015-11-04 |
SPL-106305, SPL-100624 |
Very large serverclass.conf causes the Forwarder Management page to stay blank
|
2015-11-04 |
SPL-106972 |
Installing Apps on a Universal Forwarder using the CLI results in the forwarder crashing
|
2015-11-04 |
SPL-107738 |
Forwarder management page displays with incorrect formatting
|
Distributed search and search head clustering issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-104474, SPL-103056 |
Scheduled searches after upgrading from 5.0.6 to 6.2.3 are delayed significantly leading to reports of "skipped" searches due to search processes making additional calls to the /admin/summarization endpoint
|
2015-11-04 |
SPL-104672 |
GenerationGrabberThread asserts on "ita_thread == ThreadToken::self" due to shutdown race condition
|
2015-11-04 |
SPL-104885, SPL-103012 |
Undefined props.acl causes JavaScript SDK to error and stop executing script
|
2015-11-04 |
SPL-107053 |
Unable to start the Web Server under Windows when search head pool is enabled
|
2015-11-04 |
SPL-107106 |
When SAML is enabled, SHC captain becomes unresponsive during periods with high scheduled search activity
|
2015-11-04 |
SPL-107524, SPL-106842 |
SHC Captain crash due to seg fault in CallbackRunnerThread
|
Indexers and indexer clustering issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-103900, SPL-103464 |
Buckets with invalid timebounds cause cluster peer to crash
|
2015-11-04 |
SPL-104701, SPL-102940 |
Assertion raised by archivereader thread while indexing tar log files
|
2015-11-04 |
SPL-104835, SPL-104735 |
Error message thrown in retrieving filesystem for UNC path
|
2015-11-04 |
SPL-104955, SPL-104738 |
Indexer incorrectly stops indexing due to out of disk or too many tsidx files
|
Integrated PDF generation and PDF Report Server issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-105152, SPL-104867 |
Scheduled PDF generation fails when XML encoding does not match content encoding
|
2015-11-04 |
SPL-106303, SPL-100294 |
PDF delivery fails for specific scheduled searches
|
Search, saved search, alerting, scheduling, and job management issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-103271, SPL-103270, SPL-100183 |
Warn when a large lookup table is loaded into memory!
|
2015-11-04 |
SPL-103705, SPL-103704, SPL-82385 |
default remote_timeline_fetchall = 1 in limits.conf causes searches spending long time in Finalizing status
|
2015-11-04 |
SPL-104232, SPL-104227, SPL-103419 |
Indexed lookup returns NULL result when the lookup table has large number of duplicate rows
|
2015-11-04 |
SPL-104425, SPL-104427 |
Role is automatically mapped back to user and LDAP group even after the role is deleted then re-introduced.
|
2015-11-04 |
SPL-104475, SPL-103381 |
Test email contains incorrect subject and message values
|
2015-11-04 |
SPL-104560, SPL-103416 |
Splunk add saved-search with -email parameter creates the typo with action.emai (missing the 'L') in savedsearches.conf
|
2015-11-04 |
SPL-104660, SPL-103527 |
The "fields" command cannot remove "row*" fields created by "transpose" command
|
2015-11-04 |
SPL-104884, SPL-104023 |
Show source displays blank page with message "Show source not available for this event"
|
2015-11-04 |
SPL-104951, SPL-104591 |
Regex in IFX does not allow multiline match in an event
|
2015-11-04 |
SPL-105277, SPL-99985 |
Drill-down on field returns HandleIntentionsParserDataProvider error
|
2015-11-04 |
SPL-105405, SPL-103836 |
Datamodel acceleration status needs to show the correct percentage when backfill parameter is configured
|
2015-11-04 |
SPL-107200 |
Splunk Search Process Crashes - Integer division by zero
|
2015-11-04 |
SPL-107253 |
After upgrade searches fail due to vector::_M_range_check exception because of Malformed lookup CSV files.
|
2015-11-04 |
SPL-107263 |
Backfill script does not accept wildcard for name attribute
|
2015-11-04 |
SPL-107270, SPL-103546 |
Same regex may behave differently between rex command and props.conf.
|
Splunk Web and Home interface issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-104471, SPL-103137 |
Job management view selects an incorrect app when an app name contains another app's appid
|
2015-11-04 |
SPL-104473, SPL-103538 |
Improve messaging for the form input dropdown when there are duplicate values
|
2015-11-04 |
SPL-104677, SPL-103168 |
Cursor jumps to end of line when typing anywhere inside the login form input fields
|
2015-11-04 |
SPL-104861, SPL-96663 |
GDI File directory browser breaks when running behind Apache proxy
|
2015-11-04 |
SPL-104883, SPL-104327 |
HTTP response header provides CherryPy version
|
2015-11-04 |
SPL-104886, SPL-97319 |
In Chrome, the Time field in time picker sizes incorrectly.
|
2015-11-04 |
SPL-104952, SPL-100036 |
GDI Index dropdown displays default index even if write access is not available
|
2015-11-04 |
SPL-106302, SPL-103938 |
Information in Splunk Web and inputs.conf is inconsistent when enabling or disabling TCP input
|
2015-11-04 |
SPL-107390 |
DMC Forwarders: Deployment page shows wrong figure of average events
|
Unsorted issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-103614, SPL-103613, SPL-81391 |
splunkd.log needs to continue to report a authentication forwarding error beyond restart. ERROR TcpOutputProc - Error initializing SSL context - invalid sslCertPath
|
2015-11-04 |
SPL-104078, SPL-104017 |
Splunkd crash due to assertion failure in Tailing.
|
2015-11-04 |
SPL-104515 |
The default value of max_count should be 500000 in limits.conf.spec. (Clones: SPL-104440, SPL-104512, SPL-104513, SPL-104514)
|
2015-11-04 |
SPL-104881, SPL-103335 |
Site minder proxy using unsupported “Content-type” case in XHR response headers cause GET requests to have undefined job id.
|
2015-11-04 |
SPL-105147, SPL-103293 |
support for https protocol when using googlemapview lib
|
2015-11-04 |
SPL-106838, SPL-105362 |
Corrupt/truncated info.csv causes crash in IdataDO_Collector after throwing an instance of JsonStreamingParser::error
|
2015-11-04 |
SPL-107105 |
Splunkd crashes when a SAML Attribute Query receives a bad response
|
2015-11-04 |
SPL-107563 |
SimpleXML chart data count option does not work
|
Windows-specific issues
Publication date
|
Defect number
|
Description
|
2015-11-04 |
SPL-104831, SPL-100643 |
In Windows, Data Model Acceleration fails to run due to inaccessible distributed search keyfiles.
|
2015-11-04 |
SPL-104905, SPL-94305 |
Windows Security Event Logs are missing when there is a burst of events
|
2015-11-04 |
SPL-105113, SPL-101716 |
Whitelist values ignored when configured in multiple whitelists
|
2015-11-04 |
SPL-106785, SPL-104595 |
perfmon counters at the end of input have an extra tab character at the end of their indexed value
|
2015-11-04 |
SPL-107244, SPL-104915 |
Windows events forwarded as syslog data display hostname before timestamp
|
Feedback submitted, thanks!