Release Notes

6.5.0

Splunk Enterprise 6.5.0 was released on September 27, 2016.

In addition to the following resolved issues, this release also incorporates fixes documented in the changelogs for 6.4.1, 6.4.2, and 6.4.3.

For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Data input issues

Date resolved	Issue number	Description
2016-08-11	SPL-125707, SPL-102939	Archive Processor cannot handle zip files containing entries with non-ascii utf8 chars in their filenames
2016-05-17	SPL-113738, SPL-109285	Workflow Actions will not send more than 9 POST arguments

Search issues

Date resolved	Issue number	Description
2016-08-22	SPL-123134, SPL-95575	SortProcessor::getStreamingOp crashes in appendpipe subsearch due to inserting streaming operators into report search
2016-08-11	SPL-124539, SPL-104555	Multisearch returns different results than individual searches
2016-08-03	SPL-122519, SPL-116867	Search Process crashes in dispatch thread when the custom alert condition search contains invalid search query
2016-06-30	SPL-74151	When using SimpleXML, an extra pipe in the search post process of a form runs fine on the dashboard but shows errors when linked to the search page.
2016-06-29	SPL-121968, SPL-105581	Search with an eval or calculated field which calls the tostring(..., "duration") function fails with: "Invalid number"
2016-06-29	SPL-91996, SPL-91818	No error if ref panel can't render because of ID collision.
2016-04-22	SPL-118301, SPL-117295	Add logging to LookupOperator warning users about implicitly defined lookups
2016-02-29	SPL-113654, SPL-58137	Crashing thread: DispatchReaper - assert fail in TimeFormat::render()
2016-02-23	SPL-102405	Search operator outputcsv provides no explanation for the rejection of a file name with OS separators: "/" or "\"

Saved search, alerting, scheduling, and job management issues

Date resolved	Issue number	Description
2016-08-16	SPL-124771, SPL-124301	Data Model Acceleration stops running for certain Data Models after success=0 multiple times
2016-04-12	SPL-115722, SPL-110142	'null' password gets hashed and breaks email alerts
2016-02-12	SPL-108314	After stopping Splunk and attempting splunk clean command, error occurs: Could not remove all contents of 'C:\Users\Administrator\tmp\var\lib\splunk\kvstore'

Charting, reporting, and visualization issues

Date resolved	Issue number	Description
2016-07-18	SPL-91074, SPL-91065	Submit button does not get rendered when instantiating a form via the client-side parser/factory
2016-06-30	SPL-79562	Cloned dashboard is not scheduled but "Schedule PDF Delivery" link indicates that the schedule was cloned.
2016-06-30	SPL-74151	When using SimpleXML, an extra pipe in the search post process of a form runs fine on the dashboard but shows errors when linked to the search page.
2016-06-29	SPL-91996, SPL-91818	No error if ref panel can't render because of ID collision.
2016-05-04	SPL-91211	Cascading form inputs that uses an unset condition on a form input causes a continuous loop for the form input values.
2015-12-17	SPL-76824	Dashboard returns 400 error and invalid message if "maxLines" and "count" is empty for Panel Type: Event.

Data model and pivot issues

Date resolved	Issue number	Description
2016-08-16	SPL-124771, SPL-124301	Data Model Acceleration stops running for certain Data Models after success=0 multiple times
2016-02-12	SPL-108314	After stopping Splunk and attempting splunk clean command, error occurs: Could not remove all contents of 'C:\Users\Administrator\tmp\var\lib\splunk\kvstore'

Distributed search and search head clustering issues

Date resolved	Issue number	Description
2016-08-16	SPL-124771, SPL-124301	Data Model Acceleration stops running for certain Data Models after success=0 multiple times
2016-08-15	SPL-123775, SPL-80967	Configuration bundles corrupted during creation might be replicated, causing issues in other servers.
2016-08-15	SPL-120038, SPL-115793	Error messaging unclear when there are failures creating replication bundles.
2016-08-11	SPL-125138, SPL-126603, SPL-126604	The description of shc_local_quota_check in limits.conf.spec is inaccurate
2016-06-30	SPL-123305, SPL-123479, SPL-123375	loadjob not working - statusCode=403, Forbidden
2016-05-12	SPL-119829, SPL-113189	SHC members do not always restart properly after bundle push
2016-02-18	SPL-99072	Search Head Cluster Members exit with warning while startup continues after performing rolling restart

Distributed deployment, forwarder, deployment server issues

Date resolved	Issue number	Description
2016-06-07	SPL-118097, SPL-113405	Forwarder Management Add data - Unable to add inputs with unique serverclasses and same sourcepath

Monitoring Console/DMC issues

Date resolved	Issue number	Description
2016-08-18	SPL-121813, SPL-119348	DMC doesn't support Cluster Label with space in it
2016-05-26	SPL-113844	Splunk TCP Input Performance: Instance doesn't work with pipelinesets.
2016-05-26	SPL-113843	Splunk TCP Input Performance: Deployment doesn't work with pipelinesets.
2016-02-26	SPL-101270	In the DMC, the sort button overlaps with the column separator.

Splunk Web and interface issues

Date resolved	Issue number	Description
2016-09-19	SPL-91346, SPL-91344	A user with a non-admin role but edit_user capability can map to the Roles page. User receives a message that there is an error retrieving the configuration, and cannot process the page.
2016-04-06	SPL-117137, SPL-117217	When using appServerPorts = 0 and SSL Splunkweb will not start in 6.4.0.

Windows-specific issues

Date resolved	Issue number	Description
2016-08-15	SPL-122696, SPL-118920	Windows local user added to domain group does not properly translate SID/GUIDs.

Rest, Simple XML, and Advanced XML issues

Date resolved	Issue number	Description
2016-05-17	SPL-113738, SPL-109285	Workflow Actions will not send more than 9 POST arguments

Admin and CLI issues

Date resolved	Issue number	Description
2016-04-29	SPL-32670, SPL-111916	Jobs in job manager with filter does not update after an action is performed.
2016-01-07	SPL-111916, SPL-32670	Jobs in job manager with filter does not update after an action is performed.

Uncategorized issues

Date resolved	Issue number	Description
2016-08-26	SPL-127079, SPL-127095	Duplicate events with indexerDiscovery following outages on indexer cluster.
2016-08-19	SPL-125703, SPL-98358	WARN TcpOutputProc - The event is missing source information.
2016-08-12	SPL-122187, SPL-106900	Audit trail spams splunkd.log with errors: "Failed to save seq_no=7885 for host="host::MLTPSAPV224" to disk!"
2016-08-10	SPL-96091	SimpleXML: cannot use token in <option name="count">$token$</option>
2016-08-03	SPL-122893, SPL-108622	CallbackRunnerThread may stop servicing callbacks on high load, preventing license usage rollovers.
2016-07-29	SPL-124241, SPL-118842	Missing Event Type Color for transaction search results including multiple Event Types.
2016-07-26	SPL-123603, SPL-123262	Crashing thread: indexerPipe on failing to write raw data to a hot bucket due to no space on disk
2016-06-22	SPL-122154, SPL-121693	CSV Streaming Parser crashing for quoted empty strings followed by a space and Windows newline
2016-06-20	SPL-120526, SPL-118185	When "useDeploymentServer = 1", HttpInputConf does not properly load tokens into memory
2016-05-04	SPL-115015, SPL-119570, SPL-119571, SPL-119573	Powershell Script randomly stops running untill Splunk is restarted