Release Notes

6.5.6

Splunk Enterprise 6.5.6 was released on October 26, 2017.

The following issues have been resolved in this release. For information about security fixes not related to authentication or authorization, refer to the Splunk Security Portal.

Data input issues

Date resolved	Issue number	Description
2017-08-23	SPL-130962, SPL-137275, SPL-143682, SPL-147663	Files are not getting ingested if there is missing eol
2017-08-23	SPL-142525, SPL-144297, SPL-144353, SPL-146786	Duplicated events when indexing csv files with INDEXED_EXTRACTIONS
2017-07-03	SPL-141726, SPL-142836, SPL-142837	splunkd_stderr.log.1 is not getting assigned the correct source type

Search issues

Date resolved	Issue number	Description
2017-10-11	SPL-145398, SPL-144217	searchmatch() without arguments causes crash in search process or main splunkd
2017-08-07	SPL-142569, SPL-142794, SPL-143767	BundlesSetup is taking ~4.5 sec to complete in SHC when lots of folders under etc/users
2017-07-21	SPL-142959	| metadata index limit of 5. Returns 'No results' with 6 indexes

Saved search, alerting, scheduling, and job management issues

Date resolved	Issue number	Description
2017-08-24	SPL-141957, SPL-144361, SPL-144362, SPL-144363	"ERROR datamodel - Found circular dependency when expanding datamodel" crashes splunkd
2017-07-20	SPL-141867, SPL-143250, SPL-143251	Scheduled Report having trailing white space in search query always show no results

Charting, reporting, and visualization issues

Date resolved	Issue number	Description
2017-08-18	SPL-143183	Token from Dropdown is grabbing previous value

Data model and pivot issues

Date resolved	Issue number	Description
2017-08-24	SPL-141957, SPL-144361, SPL-144362, SPL-144363	"ERROR datamodel - Found circular dependency when expanding datamodel" crashes splunkd
2017-07-20	SPL-141867, SPL-143250, SPL-143251	Scheduled Report having trailing white space in search query always show no results

Indexer and indexer clustering issues

Date resolved	Issue number	Description
2017-06-30	SPL-142500, SPL-141884	Meaning of "ERROR ClusteringHandler - handler=clustermastercontrol method expected=POST does not match actual=GET customaction=restart" message

Distributed search and search head clustering issues

Date resolved	Issue number	Description
2017-09-18	SPL-140260, SPL-144479, SPL-144480, SPL-144481	$SPLUNK_HOME/var/run/searchpeers growing due to latest common bundle in peers being stuck to an old version.
2017-07-26	SPL-141347, SPL-143381, SPL-146109, SPL-146110	Improve error message when peers closing or resetting the connection while searching
2017-07-04	SPL-142528, SPL-132443	Search bundle synchronous replication delayed by pro-active bundle lookup indexing.
2017-07-04	SPL-140831, SPL-142888, SPL-142889	Splunk not cleaning up $SPLUNK_HOME/var/run/searchpeers of .delta files and matching directories whose only non-empty subdirectory has the .index extension

Distributed deployment, forwarder, deployment server issues

Date resolved	Issue number	Description
2017-07-21	SPL-138844, SPL-143300, SPL-143301, SPL-143302	Wrong example is given for handshakeRetryIntervalInSecs in Example 4 : https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Deploymentclientconf

Monitoring Console/DMC issues

Date resolved	Issue number	Description
2017-08-04	SPL-143253, SPL-133416	DMC: Resource Usage Deployment: Load Average and Deployment-Wide Load Average panels fail to populate in windows

Splunk Web and interface issues

Date resolved	Issue number	Description
2017-08-30	SPL-142605, SPL-144510, SPL-144511, SPL-144512	Page loads slowly when there are more global saved searches
2017-07-17	SPL-139017, SPL-148608, SPL-148609, SPL-148610	The messages.po file contains French translations of css object when it shouldn't

Windows-specific issues

Date resolved	Issue number	Description
2017-08-21	SPL-142071, SPL-144219, SPL-144221, SPL-144222	splunk-winevtlog crashes on unregistering wait handle
2017-06-30	SPL-141581, SPL-142830, SPL-142831	"NumberOfProcessors" for WinHostMon is empty

Authentication and Authorization issues

Date resolved	Issue number	Description
2017-09-03	SPL-141681, SPL-143915, SPL-143916, SPL-144309	Custom web.conf:root_endpoint may cause SAML authentication to fail.
2017-08-28	SPL-142994, SPL-144489, SPL-144490, SPL-146269	SAML User session logout results in infinite loop when SLO is configured to point to SP(Splunk Logout) with ADFS
2017-08-16	SPL-141089, SPL-143593, SPL-142248, SPL-143592	SAML - Users realName and email being dropped from the UI on authentication bounce

Uncategorized issues

Date resolved	Issue number	Description
2017-08-24	SPL-143398, SPL-147086, SPL-147088, SPL-147089, SPL-147148	Slow license master response times after upgrade to 6.5 due to __tz_convert() bottleneck and extensive debug logging calls for lots of warnings
2017-08-17	SPL-144137, SPL-143846, SPL-143848, SPL-143849	Add warning to splunkd.log if vm.overcommit_memory is set to 2
2017-08-17	SPL-140406, SPL-143730, SPL-143742, SPL-145839	IPV6 env and DC fail to connect to DS using domain name
2017-08-16	SPL-142221, SPL-138909	Ran out of data while looking for end of header- archive file
2017-08-16	SPL-132666, SPL-173290, SPL-143965, SPL-143966, SPL-144174	Exported pdf shows token string for the dashboard element's title property instead of its value
2017-08-09	SPL-142911, SPL-143340, SPL-143473	License Master Performance Degradation After Upgrading to 6.5.3.1
2017-08-02	SPL-142738, SPL-143597, SPL-143598, SPL-143599	timestamps not extracted since they are more than MAX_TIMESTAMP_LOOKAHEAD characters into events
2017-07-31	SPL-134638, SPL-143382, SPL-143400, SPL-144110	Slow license master response times after upgrade to 6.5
2017-07-25	SPL-130818, SPL-143307, SPL-143308	When viewing custom time alert from email, custom time of alert triggered changes to the current time when clicking View Events from results table.
2017-07-06	SPL-141716, SPL-142915, SPL-142916	KVStoreProfilingDataInstrumentThread crash on search head due to malformed json
2017-07-06	SPL-142304, SPL-142293	Windows dev build crashes when setting non existent file to binary
2017-06-29	SPL-142296, SPL-142814, SPL-142815	Edit PDF Schedule dialog is not opening when invalid cron is set
2017-06-29	SPL-141494, SPL-142816, SPL-142817, SPL-145763	Map command in dashboard is sending empty PDF file when scheduling
2017-06-29	SPL-141621, SPL-142821, SPL-142819, SPL-142820, SPL-142822	When "Use Deployment Server" option is selected on Deployment Server, "userDeploymentServer=1" config gets wrong propagated to the Deployment Clients, because of which "HTTP Event Collector" on the clients stop accepting valid tokens
2017-06-26	SPL-141235, SPL-141522	Heavy forwarder is crashing with typing thread
2017-06-22	SPL-141928, SPL-142606, SPL-142607	CSV export results into a HTTP 500 error when the csv lookup file contains non utf-8 characters

Splunk Analytics for Hadoop

Date resolved	Issue number	Description
2017-09-11	ERP-2085, ERP-2071	Search against archived buckets throws "bad gzip header" errors; getting events outside of the search time range
2017-08-02	ERP-2047, ERP-2096, ERP-2097, ERP-2107	/hdfs/user/hunk/bundles Not Being Reaped
2017-07-24	ERP-2089, ERP-2090, ERP-2091, ERP-2100	Acceleration searches on HUNK are returning java.lang.IllegalArgumentException: No enum constant com.splunk.datasource.WriterFactory.Format exceptions
2017-07-14	ERP-2079, ERP-2103, ERP-2104, ERP-2111	Large splunk_archiver.log causes space problems.