Splunk® Enterprise

Release Notes

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF


Splunk Enterprise 6.4.7 was released on April 24, 2017.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Data input issues

Date resolved Issue number Description
2017-03-28 SPL-123321, SPL-138359, SPL-138382 Batch reader not reading a csv file with size > min_batch_size_bytes: initCRC changed after being queued (before=0x1c2f5dd4241a0cb8, after=0x9eb7fb30ce3b4a39). File growth rate must be higher than indexing or forwarding rate.
2017-03-28 SPL-108269, SPL-135550, SPL-130452, SPL-130454 $decideOnStartup not supported by modular inputs

Search issues

Date resolved Issue number Description
2017-04-19 SPL-126101, SPL-141299 The median function is incorrect if the number of values is even. Documentation implied "perc_method=interpolated" was default, but actually defaults to nearest-rank
2017-03-28 SPL-136891, SPL-112368 Search process memory tracker not performing as expected, allows the memory usage of search processes to grow well over the configured limit
2017-03-28 SPL-136347, SPL-130393 When searching over multiple indexes using disjoint time ranges in fast mode, commands which trigger batch search mode, such as stats and table, return 0 results
2017-03-22 SPL-138693, SPL-127694 Chained lookups are not supported
2017-02-28 SPL-137264, SPL-136386 stats table with reltime breaks the Sparkline

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2017-03-29 SPL-135762, SPL-120440 Paused searches are never terminated

Charting, reporting, and visualization issues

Date resolved Issue number Description
2017-02-28 SPL-137549 Space is Stripped When Dashboard is Edited (IE Only)

Data model and pivot issues

Date resolved Issue number Description
2017-03-08 SPL-135023, SPL-135452, SPL-135453 Pivot Query builder hardcodes num_of_rows to 100 when sorted by _time

Indexer and indexer clustering issues

Date resolved Issue number Description
2017-04-04 SPL-138370, SPL-119165 Indexer Clustering - fsck scan command return "Corrupted" for unsearchable buckets
2017-03-31 SPL-136734, SPL-100516 Events deleted in an index cluster via the delete search operator may be inconsistently deleted on secondaries
2017-03-28 SPL-138222 ERROR DatabaseDirectoryManager - Getting size on disk: Path for bid=xxx cannot be located.

Distributed search and search head clustering issues

Date resolved Issue number Description
2017-04-03 SPL-138439, SPL-140711, SPL-140709, SPL-140710, SPL-140712 Crashing thread: TcpChannelThread & SimpleLogClusteringProcessor
2017-03-29 SPL-136953, SPL-140591, SPL-140589, SPL-140590, SPL-141306 saved search remove_suppression request becomes bad request when saved search name contains spaces in SHC
2017-03-29 SPL-136804, SPL-138782, SPL-140777, SPL-138783 Duplicate Scheduled Real Time Searches on Search Head Cluster
2017-03-28 SPL-134426, SPL-138362, SPL-138360, SPL-138361, SPL-140838 Splunkd.log contains warning message "HTTPAuthManager - Nonce collision (nonce already used once) -- nonce: xxx, peer: splunk_sh04. Signature authentication did not succeed. Possible replay attack." when no attack took place
2017-03-28 SPL-136245, SPL-135941 Subsearch ignores default distributed search group in distsearch.conf
2017-03-07 SPL-137665, SPL-137284 Captain is throwing ERROR SHCArtifactId due to guid mismatch
2017-03-07 SPL-132295, SPL-138048, SPL-144274, SPL-144273, SPL-147403, SPL-152139 Excessive "Inconsistent bundles" Logging
2017-03-03 SPL-137554, SPL-138105, SPL-138112, SPL-138167 Search Head Clustering - mgmt_uri is showing "?" while checking with "splunk show shcluster-status"
2017-03-01 SPL-137168, SPL-135037 loadjob artifact offset not honored in SHC
2017-02-17 SPL-129098, SPL-129043 applying rolling restart to SHC destroys forward-server configuration

Universal forwarder issues

Date resolved Issue number Description
2017-03-30 SPL-140544, SPL-135562 Universal forwarder on AIX attempts to start splunkweb during internally-triggered restart, warns that "SRC did not 'stopsrc splunkweb'".

Distributed deployment, forwarder, deployment server issues

Date resolved Issue number Description
2017-03-30 SPL-135502, SPL-135570, SPL-135571 After disabling the deployment server component using CLI, a fatal error message is logged in splunkd.log
2017-03-10 SPL-138047 Forwarder Management interface should display Instance Name to avoid duplicated rows.

Windows-specific issues

Date resolved Issue number Description
2017-03-28 SPL-131264, SPL-126708 splunk-perfmon.exe locked a file unexpectedly

Authentication and Authorization issues

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Date resolved Issue number Description
2017-03-30 SPL-134858, SPL-140472, SPL-140473, SPL-140474, SPL-140475 CLI auth token, under certain conditions, not removed on logout if the system name reported by the "hostname" command differs from the Splunk server name set in server.conf
2017-03-28 SPL-135495, SPL-122822 Many ERROR UserManagerPro messages after upgrading Hunk
2017-03-28 SPL-140368, SPL-137028 SHC captain crashes after deploying changes in authentication.conf

Admin and CLI issues

Date resolved Issue number Description
2017-04-18 SPL-141085, SPL-141226, SPL-141227, SPL-141228 Default value "perc_method" for in limits.conf is incorrect

Unsorted issues

Date resolved Issue number Description
2017-03-28 SPL-137118, SPL-134451 Host field is null for UDP 514 syslog events
2017-03-13 SPL-134468, SPL-138638, SPL-138640, SPL-138637, SPL-142020 In windows /services/server/status/resource-usage/iostats and /services/server/status/partitions-space output different value of mount_point.
2017-02-17 SPL-136389, SPL-134506 nested mount points are not shown in the "/services/server/status/partitions-space" endpoint

Uncategorized issues

Date resolved Issue number Description
2017-03-30 SPL-137646 CSV export is not working for some built-in reports
2017-03-28 SPL-125047, SPL-135855, SPL-135095 Search head getting 502 while starting remote search on the peer.
2017-03-28 SPL-138271 Splunk Services stop on the Indexer due to a Crash (metadata update on bucket).
2017-03-20 SPL-136050, SPL-134977 sendemail.py does not respect action.email.include.view_link for views (scheduled PDF delivery)
2017-03-13 SPL-124256, SPL-138498, SPL-138497, SPL-138500, SPL-138501 load job command rearranges the fields/axis of the original search results
2017-03-13 SPL-138280, SPL-137866 Filter on the listing page is not returning accurate results when splunk contains thousands of dashboards/alerts/reports
2017-02-28 SPL-133876, SPL-137650, SPL-137651, SPL-137652 Rt windowed search displays incorrect results with EXTRACT- in props.conf
2017-02-16 SPL-130614, SPL-135384, SPL-135385, SPL-135387 Eventypes w/macros does not work
2017-02-09 SPL-132891, SPL-119802 PDF reports not rendering correctly
2017-02-08 SPL-135833, SPL-135356 Statistics option "display.statistics.show" still shows table information
Last modified on 26 March, 2019

This documentation applies to the following versions of Splunk® Enterprise: 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters