Release Notes

6.5.4

Splunk Enterprise 6.5.4 was released on May 25, 2017.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Upgrade issues

This section lists issues that customers have reported when upgrading from an earlier version of Splunk Enterprise. If you are considering an upgrade, please read "How to upgrade Splunk Enterprise" in the Installation Manual.

Date resolved	Issue number	Description
2017-04-21	SPL-140935, SPL-142015, SPL-142016	6.4.1 to 6.5.3 upgrade overwrites workflow_actions.conf

Search issues

Date resolved	Issue number	Description
2017-04-27	SPL-141322, SPL-138381	Lookups with multivalued keys not returning results on Windows
2017-04-27	SPL-141409, SPL-138521	Search failing with: 'Streamed search execute failed because: JournalSliceDirectory: Cannot seek to rawdata offset 0' causing alert to be fired
2017-04-27	SPL-141444, SPL-135787	Periodic Crash On Enterprise Security Search Head
2017-04-20	SPL-141255, SPL-141118	Fix Memory leak in OptimizationDoc
2017-04-20	SPL-140714, SPL-141283, SPL-141284, SPL-141285, SPL-141286	lookup, inputlookup and outputlookup commands work despite lookup table being disabled
2017-04-17	SPL-137766, SPL-136453	user based searchFilter is not applied to tstats queries.
2017-04-04	SPL-140667, SPL-140782, SPL-140783	Wildcard for srchIndexesAllowed does not appear to work for custom indexes.

Saved search, alerting, scheduling, and job management issues

Date resolved	Issue number	Description
2017-05-09	SPL-140886, SPL-130809	Backfill script may cause scheduled search to be re-ran after restart.
2017-04-28	SPL-137029, SPL-142022, SPL-142023	savedsearches.conf action.populate_lookup.dest is unable to populate KV store collections
2017-04-18	SPL-140716, SPL-141196, SPL-141167	With only Splunk 6.5.3, searches using Multikv and associated DMA consuming large amounts of memory
2017-04-05	SPL-140179, SPL-140852, SPL-140853	Email generated by backgrounded search includes incorrect search syntax
2017-03-14	SPL-137740, SPL-138471, SPL-138698	request.ui_dispatch_app parameter is ignored when constructing view link for the report and alert emails

Charting, reporting, and visualization issues

Date resolved	Issue number	Description
2017-04-04	SPL-140551, SPL-140807, SPL-140828	Spaces between "sort - " and "fields - " are removed upon a Dashboard edit in Splunk Enterprise 6.5.2 on Windows with IE 11
2017-03-31	SPL-136610, SPL-140678, SPL-140679	Dashboard *Convert to HTML* loses refresh attributes from base search.

Data model and pivot issues

Date resolved	Issue number	Description
2017-04-18	SPL-140716, SPL-141196, SPL-141167	With only Splunk 6.5.3, searches using Multikv and associated DMA consuming large amounts of memory
2017-03-17	SPL-137274, SPL-138967, SPL-138968	Pivot: area/line/bar/column charts showing multiple column values when clicking browser back button

Indexer and indexer clustering issues

Date resolved	Issue number	Description
2017-04-27	SPL-140333, SPL-141469, SPL-141467, SPL-141468	Disappearing cold bucket directories can wedge IndexerService thread (and others) while calculating bucket checksums
2017-04-14	SPL-138999, SPL-143334, SPL-142017	Change in lookup caused an unexpected indexer cluster rolling restart

Distributed search and search head clustering issues

Date resolved	Issue number	Description
2017-04-27	SPL-137415, SPL-141816, SPL-141815	SHC member crash with signal 6 (Aborted) in DistributedSearchResultCollectorThread
2017-04-21	SPL-140589, SPL-136953	saved search remove_suppression request becomes bad request when saved search name contains spaces in SHC
2017-04-21	SPL-138783, SPL-136804	Duplicate Scheduled Real Time Searches on Search Head Cluster

Universal forwarder issues

Date resolved	Issue number	Description
2017-03-31	SPL-140545, SPL-135562	Universal forwarder on AIX attempts to start splunkweb during internally-triggered restart, warns that "SRC did not 'stopsrc splunkweb'".

Distributed deployment, forwarder, deployment server issues

Date resolved	Issue number	Description
2017-04-27	SPL-138691, SPL-141462, SPL-141461	Deployment Server crashes due to deleted app still being used in memory

Monitoring Console/DMC issues

Date resolved	Issue number	Description
2017-03-17	SPL-137673, SPL-138969, SPL-138970	When running Health check on 6.5.2 Some linux items check on window some are skipped

Splunk Web and interface issues

Date resolved	Issue number	Description
2017-04-28	SPL-138546, SPL-141498, SPL-141499	Incorrect "Cron schedule description" for Powershell v3 Modular Input
2017-04-04	SPL-140667, SPL-140782, SPL-140783	Wildcard for srchIndexesAllowed does not appear to work for custom indexes.
2017-03-31	SPL-140449, SPL-140680, SPL-140681	Unable to expand syntax highlighted JSON
2017-03-16	SPL-135977, SPL-138886, SPL-138887	Improve error message on SSL errors on "browse more apps" page

Authentication and Authorization issues

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Date resolved	Issue number	Description
2017-05-05	SPL-140472, SPL-134858	CLI auth token, under certain conditions, not removed on logout if the system name reported by the "hostname" command differs from the Splunk server name set in server.conf
2017-05-02	SPL-141491, SPL-141341	Customer getting intermittent HTTP 401 & Rejecting expired token Errors
2017-04-28	SPL-140901, SPL-142018, SPL-142019	user-seed.conf.spec "how to" steps do not work
2017-04-27	SPL-140370, SPL-137028	SHC captain crashes after deploying changes in authentication.conf
2017-04-17	SPL-137766, SPL-136453	user based searchFilter is not applied to tstats queries.
2017-04-04	SPL-140667, SPL-140782, SPL-140783	Wildcard for srchIndexesAllowed does not appear to work for custom indexes.

Admin and CLI issues

Date resolved	Issue number	Description
2017-05-05	SPL-141226, SPL-141085	Default value "perc_method" for in limits.conf is incorrect

Unsorted issues

Date resolved	Issue number	Description
2017-04-27	SPL-137035, SPL-141466, SPL-141464, SPL-141465	MSI hangs when a DS is specified
2017-04-19	SPL-140847, SPL-141262, SPL-141260, SPL-141261	instrument-resource-usage fails to collect any information when /proc/diskstats is not available

Uncategorized issues

Date resolved	Issue number	Description
2017-05-23	SPL-139016, SPL-138897	Initial data is not using the correct columns
2017-05-16	SPL-133405, SPL-140769, SPL-140814, SPL-140820, SPL-142014	Working real-time searches are listed as skipped in scheduler implying there is a problem
2017-05-11	SPL-137156, SPL-141472, SPL-141473	Navigation drop-down menu of an app does not return all the saved searches when they exceed 500
2017-05-09	SPL-141326, SPL-140865	Unactionable error message when Splunk fails to move a file: renameTo failed in 1 attempt(s)... .
2017-05-04	SPL-141531, SPL-141625, SPL-141626, SPL-142506, SPL-142507	Dashboard 'Description' does not take empty string when changed with "Edit Title or Description"
2017-04-28	SPL-138873, SPL-138805	Adding columns in initial data after adding a stats command results in the incorrect columns in stats
2017-04-21	SPL-140704, SPL-141270, SPL-141271	Syntax highlighting stops working when backslash character is used between the double quotes
2017-03-31	SPL-140275, SPL-140214	Checking a column in initial data with a stats command gives the wrong columns
2017-03-17	SPL-138331, SPL-138939, SPL-138940	Search syntax highlighting stops working event if one command does not have syntax property in searchbnf.conf
2017-03-17	SPL-138803, SPL-138758	Removing a command before a stats command results in too many columns in stats
2017-03-14	SPL-133918, SPL-132355	"Edit Job Settings" doesn't work in splunkjs searchbar view
2017-03-14	SPL-138281, SPL-137866	Filter on the listing page is not returning accurate results when splunk contains thousands of dashboards/alerts/reports