Splunk® Enterprise

Release Notes

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Deprecated and removed in version 7.3

This page lists features, computing platforms, and browsers for which Splunk, Inc. has deprecated or removed support in version 7.3 of the Splunk platform.

What does "deprecated" mean?

Deprecated features, platforms, and browsers continue to work and Splunk supports them until support is removed. However, customers need to begin planning now for the future removal of support.

What does "removed" mean?

When Splunk removes support for a feature, platform, or browser it means that the feature, platform, or browser no longer works with the Splunk platform and customers must find an alternative.

Deprecated features in version 7.3

The following table summarizes the features that are deprecated in version 7.3. These features continue to be supported in version 7.3, but Splunk reminds customers that deprecated features might be removed in a future release.

Newly deprecated in this version What do I need to know? First deprecated
The tscollect command The tscollect command relies on time-series index (tsidx) files in namespaces that reside on individual search heads and are incompatible with search head clustering. This feature has been superseded by data models, which reside on the indexer and are more performant. Data models are accessible from any search head. See Accelerate data models in the Knowledge Manager Manual. Version 7.3.0
Still deprecated in this version What do I need to know? First deprecated
literals.conf Use of literals.conf has been deprecated. Use messages.conf to modify notifications that display in Splunk Web. Version 7.2.2
The static/app-packages endpoint This endpoint has been deprecated and might be removed entirely in a future release. Version 6.6.x.
The apps/appinstall endpoint This endpoint has been deprecated and might be removed entirely in a future release. Version 6.6.x.
Element-level refresh interval The element-level refresh interval option <option name="refresh.auto.interval"> has been replaced with more robust refresh controls to set both the interval/delay as well as the display type. Version 6.5.x
HeaderView and FooterView in the Splunk Web Framework HeaderView and FooterView are replaced by LayoutView. Version 6.5.x
Dashboard Framework: Dual support for option height configuration Splunk has deprecated dual support for option height configuration as "100px" and "100". Version 6.4.x
Dashboard Framework: Selected attributes of <single> Splunk has deprecated the following attributes of <single>:
  • additionalClass
  • classField
  • beforeLabel
  • afterLabel
  • linkFields
  • linkSearch
  • linkView
Version 6.4.x
SplunkWeb Legacy Mode Running SplunkWeb in Legacy Mode by setting appServerPorts = 0 in web.conf has been deprecated. This was a temporary workaround for issues that are now resolved. Normal mode provides performance and configuration benefits. Version 6.4.x
Advanced XML For future development, use Simple XML. Version 6.3.x
Simple XML <seed> tag In Simple XML <form> code blocks, use <initialValue> instead of <seed>. Version 6.3.x
Simple XML <option name = "previewResults"> tag This tag has been deprecated and might be removed entirely in a future release. Version 6.3.x
"Run a Script" alert action Use the custom alert action framework introduced in Splunk platform 6.3. Version 6.3.x
Simple XML charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag These attributes have been deprecated and might be removed entirely in a future release. Version 6.3.x
Search Head Pooling over the Network File System (NFS) protocol As an alternative, configure search head clustering. Version 6.2.x
Simple XML row grouping Row grouping is replaced by the <panel> node in Simple XML. Version 6.2.x
Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements These elements are replaced by the new <search> element. Version 6.2.x
Simple XML <earliestTime> and <latestTime> elements These elements are replaced by <earliest> and <latest> elements. Version 6.2.x
Simple XML <populatingSearch> and <populatingSavedSearch> elements These elements are replaced by the <search> element. Version 6.2.x
Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field These elements are replaced by the <condition field="..."> element. Version 6.2.x
The datamodel/acceleration REST endpoint This endpoint has been deprecated and might be removed entirely in a future release. Version 6.1.x
license_audit.log Use license_usage.log instead. Version 6.0.x
The SplunkLightForwarder app Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see Deploy a light forwarder in the Forwarding Data manual. Version 6.0.x
Pre-trained CSV and IIS sourcetypes using the CHECK_FOR_HEADER attribute Use the INDEXED_EXTRACTIONS and associated attributes instead. Version 6.0.x
The ability to deploy in multi-tenant environments using tenants.conf on a deployment server This feature has been deprecated and might be removed in a future release. Version 6.0.x
The capability for a deployment server to be a deployment client of itself This feature was disabled in version 6.0.x. It is deprecated and might be removed in a future release. Version 6.0.x
FSchange monitor Use auditd and monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows. See Monitor file system changes in Getting Data In. Version 5.x
Saved searches used within event types This feature has been deprecated and might be removed in a future release. Version 5.x
Event type auto-discovery This feature has been deprecated and might be removed in a future release. Version 5.x
Distributed block signing and event hashing This feature has been deprecated and might be removed in a future release. Version 5.x
CHECK_FOR_HEADER props.conf attribute (for index-time field extractions) This feature has been deprecated and might be removed in a future release. Version 5.x
entity.setEntity Python SDK function This feature has been deprecated and might be removed in a future release. Version 5.x
Splunk modules The following Splunk modules (elements of a view or dashboard) have been deprecated and might be removed in a future release:
  • AdvanceModeToggle
  • AjaxInclude
  • AsciiTimeline
  • CakeBrushFormatter
  • ConvertToRedirect
  • DistributedSearchServerChooser
  • HiddenIntention
  • IndexesSizes
  • MultiplexSparkline
  • PostProcessBar
  • SavedSearches
  • Segmentation
  • SimpleEventsView
Version 5.x
The setfields command The setfields command is deprecated. Version 5.x
The folderized command The folderize command is deprecated. Version 4.2

Removed features in version 7.3

Splunk has removed the following features in version 7.3; customers must immediately find alternatives:

Removed in this version What do I need to know? First deprecated
Django Web Framework Apps and pages that are built using Django Web Framework will not work in Splunk Enterprise 7.3.0 and later, and will return a 404 error. Customers should migrate Django-based apps and pages to Simple XML or HTML Dashboards framework. Version 6.3.0
The input command Searches that use the input command will no longer work in Splunk Enterprise 7.3.0 and later. To add, enable, or disable inputs, use Splunk Web or edit the inputs.conf file.

Use the following search to detect saved searches that directly utilize the input command. The results of this search do not include searches in which the input command is not present in the unparsed textual representation of the search, for example when the input command is used in a search macro.

| rest /servicesNS/-/-/saved/searches | where search LIKE "|%input%" | table title eai:acl.app eai:acl.owner search

Version 7.1.0

Planned removals

Splunk expects to remove the following previously deprecated features in the next non-maintenance release of the Splunk platform.

Feature What do I need to know? First deprecated
Splunk Web legacy mode Running SplunkWeb in Legacy Mode by setting appServerPorts = 0 in web.conf has been deprecated. This was a temporary workaround for issues that are now resolved. Normal mode provides performance and configuration benefits. Version 6.4.0
Advanced XML Search your dashboard and custom app code for the <module> tag to identify Advanced XML that needs to be updated to Simple XML. Version 6.3.0

Platform support changes in version 7.3

The following tables summarize the deprecation and removal of support for specific operating systems and file systems in this version of Splunk Enterprise.

For complete information on supported platforms, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.

Deprecated operating systems in version 7.3

The following table summarizes the deprecated operating systems in this version of Splunk Enterprise. A blank cell or an unlisted operating system indicates there is no change to support in this version.

Operating system Splunk Enterprise
with an Enterprise license
Splunk Enterprise
with a Free or Trial license
Universal forwarder
Windows 8.1 x86_64 Deprecated
Windows 8.1 x86_32 Deprecated
Windows Server 2012 R2 x86_64 Deprecated Deprecated Deprecated
Windows Server 2012 x86_64 Deprecated Deprecated Deprecated
Linux Kernel 2.6 x86-64 Deprecated Deprecated
FreeBSD 10 x86_64 Deprecated Deprecated
Mac OS X 10.12 Deprecated Deprecated
Solaris 10 Deprecated

Removed operating systems in version 7.3

The following table summarizes the removal of support for specific operating systems in this version of Splunk Enterprise. A blank cell or an unlisted operating system indicates there is no change to support in this version.

Operating system Splunk Enterprise
with an Enterprise license
Splunk Enterprise
with a Free or Trial license
Universal forwarder
Windows 8.1 x86_64 Removed
Windows Server 2008 R2 SP1 x86_64 Removed
Mac OS X 10.11 Removed Removed

Deprecated file systems in version 7.3

None.

Removed file systems in version 7.3

None.

Browser support changes in version 7.3

The following sections summarize the deprecation and removal of support for specific browsers in this version of the Splunk platform.

Deprecated browser support in version 7.3

None.

Removed browser support in version 7.3

None.

Last modified on 17 March, 2022
Fixed issues   Credits

This documentation applies to the following versions of Splunk® Enterprise: 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters