Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF


Splunk Enterprise 6.4.8 was released on June 21, 2017.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Search issues

Date resolved Issue number Description
2017-06-05 SPL-129875, SPL-138852, SPL-138849, SPL-138850, SPL-138851 Turkey timezone change to +03:00 (permanent Daylight Saving)
2017-06-01 SPL-141286, SPL-140714 lookup, inputlookup and outputlookup commands work despite lookup table being disabled
2017-04-27 SPL-138521, SPL-141459, SPL-141005, SPL-141409, SPL-141460 Search failing with: 'Streamed search execute failed because: JournalSliceDirectory: Cannot seek to rawdata offset 0' causing alert to be fired
2017-04-21 SPL-138381, SPL-141325, SPL-141322, SPL-141324 Indexed csv lookups with multivalued keys not returning results on Windows
2017-04-19 SPL-140647, SPL-138936 When assureUTF8 is enabled in indexes.conf, errors found in search.log: ERROR RawdataJournal - Converting invalid UTF-8 found in rawdata

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2017-04-06 SPL-130809, SPL-140887, SPL-140889, SPL-140886, SPL-140888 Backfill script may cause scheduled search to be re-run after restart.

Indexer and indexer clustering issues

Date resolved Issue number Description
2017-06-01 SPL-141861 dbinspect showing double the size that it should be

Distributed search and search head clustering issues

Date resolved Issue number Description
2017-05-30 SPL-137017, SPL-130771 Improvement for "Rejecting expired token" Warning Message
2017-05-26 SPL-140661, SPL-137319 Search head cluster member can't recover from REMOTE_CHKSUM_UNMATCHED error during bundle replication after SHC captaincy.

Distributed deployment, forwarder, deployment server issues

Date resolved Issue number Description
2017-06-01 SPL-141434, SPL-116884 When editing forwarded input with same source path, the changes get applied to a different input

Splunk Web and interface issues

Date resolved Issue number Description
2017-05-10 SPL-119677, SPL-101865, SPL-141731, SPL-141729, SPL-141730 Default appLogo.png file deleted - causing 404 errors in the browser console

Rest, Simple XML, and Advanced XML issues

Date resolved Issue number Description
2017-05-19 SPL-141538, SPL-141908, SPL-141906, SPL-141907 HandleJobsDataProvider logs warning for failure to save search history for user=nobody.

Admin and CLI issues

Date resolved Issue number Description
2017-06-01 SPL-123562, SPL-142133, SPL-142135, SPL-142137, SPL-142134, SPL-142136 'splunk help status' confusing for splunkweb status when spawned as part of splunkd

Unsorted issues

Date resolved Issue number Description
2017-06-15 SPL-137981, SPL-142197, SPL-142195, SPL-142196 TCP input from pan syslog device throwing "TcpOutputProc - Pipeline data does not have indexKey" though index is defined in inputs.conf

Uncategorized issues

Date resolved Issue number Description
2017-06-01 SPL-140904 Simple XML TRP Date & Timerange preset with wrong time
2017-06-01 SPL-142126, SPL-133807 Crashing thread ExecProcessorSchedulerThread on RHEL 6.5 and Splunk 6.5.1
2017-04-21 SPL-140865, SPL-141327, SPL-141329, SPL-141326, SPL-141328 Unactionable error message when Splunk fails to move a file: renameTo failed in 1 attempt(s)... .
2017-04-05 SPL-140814, SPL-133405 Working real-time searches are listed as skipped in scheduler implying there is a problem

This documentation applies to the following versions of Splunk® Enterprise: 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters