Splunk® Enterprise

Release Notes

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Fixed issues

Splunk Enterprise 7.1.6 was released on January 22, 2019. This release includes fixes for the following issues.

Issues are listed in all relevant sections. Some issues might appear more than once. To check for additional security issues related to this release, visit the Splunk Security Portal.

Search issues

Date resolved Issue number Description
2019-01-04 SPL-164145, SPL-163825 Search process management may fail on race conditions resulting in spurious status as in SPL-152541.
2019-01-02 SPL-162377, SPL-162654, SPL-164427 Crashed on Thread: searchOrchestrator
2018-12-19 SPL-163887, SPL-162433 Precision may be truncated in accum, addtotals, addcoltotals commands based on event ordering
2018-12-03 SPL-161876, SPL-156123 Realtime search causes memory usage constant grow.
2018-12-03 SPL-159979, SPL-161169, SPL-163063 Crashing Thread: TcpChannelThread - Post process search using stats fields with null crashes Splunk
2018-11-19 SPL-162447, SPL-154678 |metadata search error - Failed to apply deletes to some metadata
2018-11-07 SPL-160507, SPL-158401 Search with a FullFilePath containing \\ produce less events than with * and less over a longer period
2018-11-07 SPL-159002, SPL-162599, SPL-162669, SPL-162896, SPL-162965 Search process crashing - thread: phase_1 - Segmentation fault in LookupTable::applyLookup
2018-11-06 SPL-160295, SPL-159400 Assertion in PortableIovecCursor::bytesLeftToWrite() during search job export
2018-11-05 SPL-162495, SPL-144752 Token values are not extracted all the time with sendemail command
2018-10-25 SPL-162158, SPL-159006 Memmapping Errors when using geospatial lookups
2018-10-23 SPL-161870, SPL-153621 Search shows "No results found" intermittently due to difference in minutes part between timezones of splunk instance and user preference

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2018-10-25 SPL-144102, SPL-157984, SPL-161715, SPL-161717 Custom Alert Action Parameters fails when Search has | (pipe) in its name

Charting, reporting, and visualization issues

Date resolved Issue number Description
2018-12-06 SPL-157994, SPL-162690, SPL-163622 HTML content inside dashboard XML can't be localized
2018-10-23 SPL-158788, SPL-160687, SPL-161706, SPL-161707, SPL-161708 Scheduling PDF from Exporting Dashboard UI Issue

Indexer and indexer clustering issues

Date resolved Issue number Description
2019-01-07 SPL-164156, SPL-162733 Rolling-restart fails on some search heads or indexers
2018-12-20 SPL-162310, SPL-156164 Shutdown sequence does not begin after master has instructed peer to restart during rolling restart phase of a bundle push
2018-11-14 SPL-162801, SPL-161301 For a multisite cluster, splunk is not reaping prior search-buckets manifests after new generation
2018-10-26 SPL-162291, SPL-155681 Splunk on a search head, hits OOM killer by storing a vast, untold, quantity of messages

Distributed search and search head clustering issues

Date resolved Issue number Description
2019-01-07 SPL-164156, SPL-162733 Rolling-restart fails on some search heads or indexers
2019-01-07 SPL-164477, SPL-141869 App bundle push issued from SHC app deployer extremely slow
2019-01-03 SPL-164271, SPL-164134 Search performance degrading over time
2018-12-14 SPL-162341, SPL-163623, SPL-163624 Artifacts are not being reaped in a timely manner causing searches to be queued
2018-12-05 SPL-163488, SPL-162318 DispatchReaper fails to reap artifacts from fill_summary_index.py in SH Cluster

Universal forwarder issues

Date resolved Issue number Description
2019-01-04 SPL-163271, SPL-159337 Splunk UF crashing due to invalid EVENT_BREAKER
2019-01-02 SPL-156799, SPL-163832, SPL-164282, SPL-172249 Forwarder fails to restart when disableDefaultPort=true but port is being used
2018-11-20 SPL-163081, SPL-161891 RPM dependencies (/bin/mv, uname, which, hostname)

Distributed deployment, forwarder, deployment server issues

Date resolved Issue number Description
2019-01-16 SPL-161044, SPL-141772 App deployment fails sporadically on Windows

Monitoring Console/DMC issues

Date resolved Issue number Description
2018-12-11 SPL-161714, SPL-163188, SPL-163189 Saving server roles in DMC "configure" view results in 409 Conflict error response code when there is more than 30 groups defined

Windows-specific issues

Date resolved Issue number Description
2019-01-02 SPL-162353, SPL-158197 splunk-regmon - failed to start the driver due to permission issue
2018-10-26 SPL-162147, SPL-145841 MonitorNoHandle do not respect _TCP_ROUTING in inputs.conf

Authentication and Authorization issues

For a list of security issues, please see the Security Advisory. A list of all recent advisories can be found in the Security Portal.

Date resolved Issue number Description
2018-11-29 SPL-161630, SPL-145067 Exclude user "nobody" from LDAP searches
2018-11-15 SPL-162483, SPL-159552 SAML - "role" not parsing comma separated list
2018-11-06 SPL-161367, SPL-160537 saml - "Did not find a saml session index for this session, maybe a local user" should be WARN

Admin and CLI issues

Date resolved Issue number Description
2019-01-09 SPL-160864, SPL-164243, SPL-164561 Excessive logging of external scheme definitions by SpecFiles
2018-11-22 SPL-163099, SPL-154372 Shared embedded report is not loading when admin is logged in

Unsorted issues

Date resolved Issue number Description
2019-01-04 SPL-163271, SPL-159337 Splunk UF crashing due to invalid EVENT_BREAKER
2019-01-02 SPL-163553, SPL-157146 Diag with SPLUNK_DB set to drive name and \ results in improper format on Windows
2018-12-10 SPL-154925, SPL-161164, SPL-162971 KVstore restore failure sometimes when having >1000 rows in the collection
2018-12-05 SPL-163299, SPL-162714 HEC: Source is not logged when invalid token is used

Uncategorized issues

Date resolved Issue number Description
2019-01-08 SPL-164251, SPL-163808 CIM Setup page is showing single line because of syntax error in underlying search
2019-01-03 SPL-163531, SPL-162247 After adding Tags Whitelist for Data Models, the newly added tags disappears when there is a change in the acceleration setting for the respective datamodel from the UI.
2019-01-03 SPL-164267, SPL-158199 when merging tsidx files, splunk optimize failed to open temporary manifest file due to file name collision cause by race condition
2018-12-18 SPL-158779, SPL-160529, SPL-163474 Indexer search process crash with thread: BatchSearch
2018-12-14 SPL-163975, SPL-157230 conf-mutator.pid cleanup error during GUI initiated restart
2018-12-06 SPL-158665, SPL-162689, SPL-163621 Token inside HTML element is not localized
2018-11-27 SPL-163030, SPL-157014 Search results on a dashboard are given with system timezone instead of user timezone
2018-11-20 SPL-162981, SPL-152828 Splunk does not start as specified user on boot on MacOS
2018-11-19 SPL-158551, SPL-157891 Unable to open bucket as bucket is stuck in stale state
2018-11-14 SPL-162724, SPL-159413 "Failed to localize" due to "ERROR CacheManagerHandler"..."not an owner"..."and the bucket is draining"
2018-11-14 SPL-160401, SPL-158148 S2 Migration - Remove-excess-buckets triggering summary reaping from S3 inadvertently - Customer seeing slow searches when using tstats / dma
2018-11-09 SPL-161253, SPL-159966 ADP: "Failed to localize" after startup because bucket is not registered with the CacheManager until repair finishes
2018-11-07 SPL-160230, SPL-160099 Splunkd web fails to start due to deadlock among Health Reporter threads
2018-11-06 SPL-162307, SPL-161462 Splunk is crashing with CacheManager FATAL error
2018-11-06 SPL-158943, SPL-157993, SPL-163684 S2 / Indexes UI - When maxTotalDataSizeMB != maxGlobalDataSizeMB only maxTotalDataSizeMB shown in UI on S2
2018-10-25 SPL-161770, SPL-159234 Splunk WebUI always defaults to http://localhost:8000/en-US local even if browser is configured to use other language
2018-10-10 SPL-161122, SPL-154451 Only 100 indexes are listed when creating or modifying a HEC on SH
Last modified on 07 August, 2020
Timestamp recognition of dates with two-digit years fails beginning January 1, 2020
Deprecated features

This documentation applies to the following versions of Splunk® Enterprise: 7.1.6

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters