Fixed issues
Splunk Enterprise 7.1.6 was released on January 22, 2019. This release includes fixes for the following issues.
Issues are listed in all relevant sections. Some issues might appear more than once. To check for additional security issues related to this release, visit the Splunk Security Portal.
Authentication and authorization issues
Date resolved
|
Issue number
|
Description
|
2018-11-29 |
SPL-161630, SPL-145067 |
Exclude user "nobody" from LDAP searches
|
2018-11-15 |
SPL-162483, SPL-159552 |
SAML - "role" not parsing comma separated list
|
2018-11-06 |
SPL-161367, SPL-160537 |
saml - "Did not find a saml session index for this session, maybe a local user" should be WARN
|
Data input issues
Date resolved
|
Issue number
|
Description
|
2018-12-05 |
SPL-163299, SPL-162714 |
HEC: Source is not logged when invalid token is used
|
Search issues
Date resolved
|
Issue number
|
Description
|
2019-01-04 |
SPL-164145, SPL-163825 |
Search process management may fail on race conditions resulting in spurious status as in SPL-152541.
|
2019-01-02 |
SPL-162377, SPL-162654, SPL-164427 |
Crashed on Thread: searchOrchestrator
|
2018-12-19 |
SPL-163887, SPL-162433 |
Precision may be truncated in accum, addtotals, addcoltotals commands based on event ordering
|
2018-12-03 |
SPL-161876, SPL-156123 |
Realtime search causes memory usage constant grow.
|
2018-12-03 |
SPL-159979, SPL-161169, SPL-163063 |
Crashing Thread: TcpChannelThread - Post process search using stats fields with null crashes Splunk
|
2018-11-19 |
SPL-162447, SPL-154678 |
|metadata search error - Failed to apply deletes to some metadata
|
2018-11-07 |
SPL-160507, SPL-158401 |
Search with a FullFilePath containing \\ produce less events than with * and less over a longer period
|
2018-11-07 |
SPL-159002, SPL-162599, SPL-162669, SPL-162896, SPL-162965 |
Search process crashing - thread: phase_1 - Segmentation fault in LookupTable::applyLookup
|
2018-11-06 |
SPL-160295, SPL-159400 |
Assertion in PortableIovecCursor::bytesLeftToWrite() during search job export
|
2018-11-05 |
SPL-162495, SPL-144752 |
Token values are not extracted all the time with sendemail command
|
2018-10-25 |
SPL-162158, SPL-159006 |
Memmapping Errors when using geospatial lookups
|
2018-10-23 |
SPL-161870, SPL-153621 |
Search shows "No results found" intermittently due to difference in minutes part between timezones of splunk instance and user preference
|
Saved search, alerting, scheduling, and job management issues
Date resolved
|
Issue number
|
Description
|
2018-10-25 |
SPL-144102, SPL-157984, SPL-161715, SPL-161717 |
Custom Alert Action Parameters fails when Search has | (pipe) in its name
|
Charting, reporting, and visualization issues
Date resolved
|
Issue number
|
Description
|
2018-12-06 |
SPL-157994, SPL-162690, SPL-163622 |
HTML content inside dashboard XML can't be localized
|
2018-10-23 |
SPL-158788, SPL-160687, SPL-161706, SPL-161707, SPL-161708 |
Scheduling PDF from Exporting Dashboard UI Issue
|
Indexer and indexer clustering issues
Date resolved
|
Issue number
|
Description
|
2019-01-07 |
SPL-164156, SPL-162733 |
Rolling-restart fails on some search heads or indexers
|
2018-12-20 |
SPL-162310, SPL-156164 |
Shutdown sequence does not begin after master has instructed peer to restart during rolling restart phase of a bundle push
|
2018-11-14 |
SPL-162801, SPL-161301 |
For a multisite cluster, splunk is not reaping prior search-buckets manifests after new generation
|
2018-10-26 |
SPL-162291, SPL-155681 |
Splunk on a search head, hits OOM killer by storing a vast, untold, quantity of messages
|
Distributed search and search head clustering issues
Date resolved
|
Issue number
|
Description
|
2019-01-07 |
SPL-164156, SPL-162733 |
Rolling-restart fails on some search heads or indexers
|
2019-01-07 |
SPL-164477, SPL-141869 |
App bundle push issued from SHC app deployer extremely slow
|
2019-01-03 |
SPL-164271, SPL-164134 |
Search performance degrading over time
|
2018-12-14 |
SPL-162341, SPL-163623, SPL-163624 |
Artifacts are not being reaped in a timely manner causing searches to be queued
|
2018-12-05 |
SPL-163488, SPL-162318 |
DispatchReaper fails to reap artifacts from fill_summary_index.py in SH Cluster
|
Universal forwarder issues
Date resolved
|
Issue number
|
Description
|
2019-01-04 |
SPL-163271, SPL-159337 |
Splunk UF crashing due to invalid EVENT_BREAKER
|
2019-01-02 |
SPL-156799, SPL-163832, SPL-164282, SPL-172249 |
Forwarder fails to restart when disableDefaultPort=true but port is being used
|
2018-11-20 |
SPL-163081, SPL-161891 |
RPM dependencies (/bin/mv, uname, which, hostname)
|
Distributed deployment, forwarder, deployment server issues
Date resolved
|
Issue number
|
Description
|
2019-01-16 |
SPL-161044, SPL-141772 |
App deployment fails sporadically on Windows
|
Monitoring Console issues
Date resolved
|
Issue number
|
Description
|
2018-12-11 |
SPL-161714, SPL-163188, SPL-163189 |
Saving server roles in DMC "configure" view results in 409 Conflict error response code when there is more than 30 groups defined
|
2018-11-07 |
SPL-160230, SPL-160099 |
Splunkd web fails to start due to deadlock among Health Reporter threads
|
Windows-specific issues
Date resolved
|
Issue number
|
Description
|
2019-01-02 |
SPL-162353, SPL-158197 |
splunk-regmon - failed to start the driver due to permission issue
|
2018-10-26 |
SPL-162147, SPL-145841 |
MonitorNoHandle do not respect _TCP_ROUTING in inputs.conf
|
Admin and CLI issues
Date resolved
|
Issue number
|
Description
|
2019-01-09 |
SPL-160864, SPL-164243, SPL-164561 |
Excessive logging of external scheme definitions by SpecFiles
|
2018-11-22 |
SPL-163099, SPL-154372 |
Shared embedded report is not loading when admin is logged in
|
Uncategorized issues
Date resolved
|
Issue number
|
Description
|
2019-01-08 |
SPL-164251, SPL-163808 |
CIM Setup page is showing single line because of syntax error in underlying search
|
2019-01-03 |
SPL-163531, SPL-162247 |
After adding Tags Whitelist for Data Models, the newly added tags disappears when there is a change in the acceleration setting for the respective datamodel from the UI.
|
2019-01-03 |
SPL-164267, SPL-158199 |
when merging tsidx files, splunk optimize failed to open temporary manifest file due to file name collision cause by race condition
|
2019-01-02 |
SPL-163553, SPL-157146 |
Diag with SPLUNK_DB set to drive name and \ results in improper format on Windows
|
2018-12-18 |
SPL-158779, SPL-160529, SPL-163474 |
Indexer search process crash with thread: BatchSearch
|
2018-12-14 |
SPL-163975, SPL-157230 |
conf-mutator.pid cleanup error during GUI initiated restart
|
2018-12-10 |
SPL-154925, SPL-161164, SPL-162971 |
KVstore restore failure sometimes when having >1000 rows in the collection
|
2018-12-06 |
SPL-158665, SPL-162689, SPL-163621 |
Token inside HTML element is not localized
|
2018-11-27 |
SPL-163030, SPL-157014 |
Search results on a dashboard are given with system timezone instead of user timezone
|
2018-11-20 |
SPL-162981, SPL-152828 |
Splunk does not start as specified user on boot on MacOS
|
2018-11-19 |
SPL-158551, SPL-157891 |
Unable to open bucket as bucket is stuck in stale state
|
2018-11-14 |
SPL-162724, SPL-159413 |
"Failed to localize" due to "ERROR CacheManagerHandler"..."not an owner"..."and the bucket is draining"
|
2018-11-14 |
SPL-160401, SPL-158148 |
S2 Migration - Remove-excess-buckets triggering summary reaping from S3 inadvertently - Customer seeing slow searches when using tstats / dma
|
2018-11-09 |
SPL-161253, SPL-159966 |
ADP: "Failed to localize" after startup because bucket is not registered with the CacheManager until repair finishes
|
2018-11-06 |
SPL-162307, SPL-161462 |
Splunk is crashing with CacheManager FATAL error
|
2018-11-06 |
SPL-158943, SPL-157993, SPL-163684 |
S2 / Indexes UI - When maxTotalDataSizeMB != maxGlobalDataSizeMB only maxTotalDataSizeMB shown in UI on S2
|
2018-10-25 |
SPL-161770, SPL-159234 |
Splunk WebUI always defaults to http://localhost:8000/en-US local even if browser is configured to use other language
|
2018-10-10 |
SPL-161122, SPL-154451 |
Only 100 indexes are listed when creating or modifying a HEC on SH
|
Feedback submitted, thanks!