Splunk® Enterprise

Release Notes

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF


Splunk Enterprise 6.4.8 was released on June 21, 2017.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Search issues

Date resolved Issue number Description
2017-06-05 SPL-129875, SPL-138849, SPL-138850, SPL-138851, SPL-138852 Turkey timezone change to +03:00 (permanent Daylight Saving)
2017-06-01 SPL-141286, SPL-140714 lookup, inputlookup and outputlookup commands work despite lookup table being disabled
2017-04-27 SPL-138521, SPL-141459, SPL-141005, SPL-141409, SPL-141460 Search failing with: 'Streamed search execute failed because: JournalSliceDirectory: Cannot seek to rawdata offset 0' causing alert to be fired
2017-04-21 SPL-138381, SPL-141322, SPL-141324, SPL-141325 Indexed csv lookups with multivalued keys not returning results on Windows
2017-04-19 SPL-140647, SPL-138936 When assureUTF8 is enabled in indexes.conf, errors found in search.log: ERROR RawdataJournal - Converting invalid UTF-8 found in rawdata

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2017-04-06 SPL-130809, SPL-140886, SPL-140887, SPL-140888, SPL-140889 Backfill script may cause scheduled search to be re-run after restart.

Distributed search and search head clustering issues

Date resolved Issue number Description
2017-05-30 SPL-137017, SPL-130771 Improvement for "Rejecting expired token" Warning Message
2017-05-26 SPL-140661, SPL-137319 Search head cluster member can't recover from REMOTE_CHKSUM_UNMATCHED error during bundle replication after SHC captaincy.

Distributed deployment, forwarder, deployment server issues

Date resolved Issue number Description
2017-06-01 SPL-141434, SPL-116884 When editing forwarded input with same source path, the changes get applied to a different input

Splunk Web and interface issues

Date resolved Issue number Description
2017-05-10 SPL-119677, SPL-101865, SPL-141729, SPL-141730, SPL-141731 Default appLogo.png file deleted - causing 404 errors in the browser console

Rest, Simple XML, and Advanced XML issues

Date resolved Issue number Description
2017-05-19 SPL-141538, SPL-141906, SPL-141907, SPL-141908 HandleJobsDataProvider logs warning for failure to save search history for user=nobody.

Authentication and Authorization issues

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Date resolved Issue number Description
2017-05-30 SPL-137017, SPL-130771 Improvement for "Rejecting expired token" Warning Message

Admin and CLI issues

Date resolved Issue number Description
2017-06-01 SPL-123562, SPL-142133, SPL-142134, SPL-142135, SPL-142136, SPL-142137 'splunk help status' confusing for splunkweb status when spawned as part of splunkd

Unsorted issues

Date resolved Issue number Description
2017-06-15 SPL-137981, SPL-142195, SPL-142196, SPL-142197 TCP input from pan syslog device throwing "TcpOutputProc - Pipeline data does not have indexKey" though index is defined in inputs.conf

Uncategorized issues

Date resolved Issue number Description
2017-06-01 SPL-140904 Simple XML TRP Date & Timerange preset with wrong time
2017-06-01 SPL-142126, SPL-133807 Crashing thread ExecProcessorSchedulerThread on RHEL 6.5 and Splunk 6.5.1
2017-06-01 SPL-141861 dbinspect showing double the size that it should be
2017-04-21 SPL-140865, SPL-141326, SPL-141327, SPL-141328, SPL-141329 Unactionable error message when Splunk fails to move a file: renameTo failed in 1 attempt(s)... .
2017-04-05 SPL-140814, SPL-133405 Working real-time searches are listed as skipped in scheduler implying there is a problem
Last modified on 25 March, 2019

This documentation applies to the following versions of Splunk® Enterprise: 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters