Splunk® Enterprise

Release Notes

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF


Splunk Enterprise 6.6.3 was released on August 21, 2017.

For information about other security fixes, refer to the Splunk Security Portal.

Issues are listed in all relevant sections. Some issues appear more than once.

Upgrade issues

This section lists issues that customers have reported when upgrading from an earlier version of Splunk Enterprise. If you are considering an upgrade, please read "How to upgrade Splunk Enterprise" in the Installation Manual.

Date resolved Issue number Description
2017-06-14 SPL-142015, SPL-140935 6.4.1 to 6.5.3 upgrade overwrites workflow_actions.conf

Data input issues

Date resolved Issue number Description
2017-07-31 SPL-142267, SPL-138879, STREAM-3824 Modular Input Initialization Ignoring Indexer Clustering Folders

Search issues

Date resolved Issue number Description
2017-08-09 SPL-143767, SPL-142569 BundlesSetup is taking ~4.5 sec to complete in SHC when lots of folders under etc/users
2017-07-26 SPL-141283, SPL-140714 lookup, inputlookup and outputlookup commands work despite lookup table being disabled
2017-07-26 SPL-142497, SPL-143374 Consecutive calls to random() return repeating values in a predictable pattern.
2017-07-13 SPL-140650, SPL-138936 When assureUTF8 is enabled in indexes.conf, errors found in search.log: ERROR RawdataJournal - Converting invalid UTF-8 found in rawdata
2017-07-06 SPL-141005, SPL-138521 Search failing with: 'Streamed search execute failed because: JournalSliceDirectory: Cannot seek to rawdata offset 0' causing alert to be fired
2017-06-20 SPL-142400, SPL-142447 Unable to filter saved searches using the text which exists in the saved search's search string
2017-06-15 SPL-142198, SPL-141751 Sparkline fails to render for the panel which was in hidden state previously

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2017-07-31 SPL-140852, SPL-140179 Email generated by backgrounded search includes incorrect search syntax
2017-07-26 SPL-142339, SPL-142799 Errno 2 on all attempts to send email with search results.
2017-07-26 SPL-143250, SPL-141867 Scheduled Report having trailing white space in search query always show no results
2017-07-25 SPL-142801, SPL-142771 Only one root event search in a DM gets accelerated
2017-07-25 SPL-143307, SPL-130818 When viewing custom time alert from email, custom time of alert triggered changes to the current time when clicking View Events from results table.
2017-07-20 SPL-141887, SPL-141823 SearchParser Errors for Datamodel Acceleration prevents other scheduled searches from being executed
2017-06-16 SPL-142225, SPL-142383 Cron schedules involving ranges for months or days of months are off by one

Data model and pivot issues

Date resolved Issue number Description
2017-07-25 SPL-142801, SPL-142771 Only one root event search in a DM gets accelerated
2017-07-21 SPL-138967, SPL-137274 Pivot: area/line/bar/column charts showing multiple column values when clicking browser back button

Indexer and indexer clustering issues

Date resolved Issue number Description
2017-07-19 SPL-142259, SPL-143201 Pass4SymmKey fails with special characters
2017-07-03 SPL-141985, SPL-143351 Could not bind to port IPv4 port
2017-06-16 SPL-141773, SPL-142457 Some Indexes Not Fully Searchable After 6.6.0 Upgrade when multiple peers deleted the bucket and bucket is not frozen

Distributed search and search head clustering issues

Date resolved Issue number Description
2017-07-31 SPL-142487, SPL-141598 high cpu on listening thread on indexers - Could be root cause of timeouts seen on env
2017-07-24 SPL-142888, SPL-140831 Splunk not cleaning up $SPLUNK_HOME/var/run/searchpeers of .delta files and matching directories whose only non-empty subdirectory has the .index extension
2017-07-24 SPL-140663, SPL-137319 Search head cluster member can't recover from REMOTE_CHKSUM_UNMATCHED error during bundle replication after SHC captaincy.
2017-07-07 SPL-140590, SPL-136953 saved search remove_suppression request becomes bad request when saved search name contains spaces in SHC

Monitoring Console/DMC issues

Date resolved Issue number Description
2017-07-04 SPL-142474, SPL-142793 "Search Peer Not Responding" does not trigger DMC Alert

Splunk Web and interface issues

Date resolved Issue number Description
2017-07-17 SPL-142386, SPL-141871 Add Data UI sets SHOULD_LINEMERGE incorrectly
2017-06-29 SPL-141498, SPL-138546 Incorrect "Cron schedule description" for Powershell v3 Modular Input
2017-06-29 SPL-141730, SPL-119677 Default appLogo.png file deleted - causing 404 errors in the browser console
2017-06-20 SPL-142400, SPL-142447 Unable to filter saved searches using the text which exists in the saved search's search string
2017-06-15 SPL-142101, SPL-141853 Date format in the timerange picker is wrong for the "fr-FR" locale
2017-06-15 SPL-142198, SPL-141751 Sparkline fails to render for the panel which was in hidden state previously

Windows-specific issues

Date resolved Issue number Description
2017-07-27 SPL-142415, SPL-143438 WMI events with corrupted index names, source, sourcetypes and/or incomplete event bodies forwarded by HWFs
2017-07-26 SPL-142830, SPL-141581 "NumberOfProcessors" for WinHostMon is empty

Rest, Simple XML, and Advanced XML issues

Date resolved Issue number Description
2017-07-24 SPL-141907, SPL-141538 HandleJobsDataProvider logs warning for failure to save search history for user=nobody.

Authentication and Authorization issues

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Date resolved Issue number Description
2017-07-31 SPL-142018, SPL-140901 user-seed.conf.spec "how to" steps do not work

Admin and CLI issues

Date resolved Issue number Description
2017-06-16 SPL-142136, SPL-123562 'splunk help status' confusing

Unsorted issues

Date resolved Issue number Description
2017-08-01 SPL-136496, SPL-141953, SPL-141956 Issues with indexer hardening / binding to multiple IP
2017-07-26 SPL-143340, SPL-142911 License Master Performance Degradation After Upgrading to 6.5.x when configured with high number of source, sourcetypes, hosts
2017-07-26 SPL-142819, SPL-141621 When "Use Deployment Server" option is selected on DeploymentServer,"userDeploymentServer=1" config gets wrong propagated to the DeploymentClients,because of which "HTTP Event Collector" on the clients stop accepting valid tokens
2017-07-24 SPL-141519, SPL-137942 (kimono) - KVstore cdriver does not support IPv6 only hostnames
2017-07-24 SPL-142063, SPL-135664 Installer ignores Windows Event Logs Options Under Certain Conditions
2017-07-20 SPL-142606, SPL-141928 CSV export results into a HTTP 500 error when the csv lookup file contains non utf-8 characters
2017-07-19 SPL-142059, SPL-143200 KVstore fails to initialise with hostname of length greater than 64 characters
2017-07-19 SPL-142915, SPL-141716 KVStoreProfilingDataInstrumentThread crash on search head due to malformed json
2017-07-18 SPL-142196, SPL-137981 TCP input from pan syslog device throwing "TcpOutputProc - Pipeline data does not have indexKey" though index is defined in inputs.conf
2017-07-17 SPL-141818, SPL-141079 IOStats is not being collected and ingested into _introspection
2017-07-14 SPL-141718, SPL-143117 Splunkweb Appserver may take a long time to start due to SWA/splunk_instrumentation

Uncategorized issues

Date resolved Issue number Description
2017-08-02 SPL-142098, SPL-138910 Deprecated feature "Audit Signing" is not removed from Splunk documentation and audit.conf.spec in 6.3.0 and above
2017-07-27 SPL-143281, SPL-143431 Broken @go URL "The view you requested could not be found"
2017-07-27 SPL-142724, SPL-143409 Exact floating point calculations in eval may produce incorrect arithmetic groupings with search optimization enabled.
2017-07-26 SPL-142814, SPL-142296 Edit PDF Schedule dialog is not opening when invalid cron is set
2017-07-26 SPL-142438, SPL-142840 The ticks of the overlay y-axis are not auto adjusted when the chart's stack mode is set to Stacked 100%
2017-07-25 SPL-138500, SPL-124256 load job command rearranges the fields/axis of the original search results
2017-07-25 SPL-143212, SPL-142342 Cannot reach default search pages for some applications
2017-07-24 SPL-141959, SPL-141655 JSChart prevents custom time range from being selected
2017-07-20 SPL-142065, SPL-138443 Better messaging for invalid server.conf, sslVersion setting using quotes ("tls")
2017-07-14 SPL-141947, SPL-143002 Splunk does not work with Internet Explorer version 11 in Compatibility Mode
2017-07-06 SPL-142215, SPL-142917 Upgrade from 6.5.2 to 6.6 heavy crashes with sig abort in TimeFormat constructor
2017-07-06 SPL-142086, SPL-141319 Crash thread: parsing CsvLineBreaker::parser::gotEol
2017-06-29 SPL-141727, SPL-140946 SplunkWeb hang because of log rotation configuration of python.log

Splunk Analytics for Hadoop

Date resolved Issue number Description
2017-07-25 ERP-2056, ERP-2038 Archiving process throwing Out Of Memory Error
2017-06-29 ERP-2051, ERP-2026 Hunk search job has failed, despite that the related hadoop maps have eventually succeeded
2017-06-29 ERP-2063, ERP-2039 Enhance BucketExporter to leverage Hadoop Client's configured io.buffer.size and set blocksize to FS default blocksize
2017-06-29 ERP-2073, ERP-2024 Post 6.3.9 upgrade issue: Search failing to finalizing with "ERROR ERP.splunk_hdfs - java.lang.RuntimeException: Parent search is done. "
Last modified on 29 March, 2019

This documentation applies to the following versions of Splunk® Enterprise: 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters