Splunk® Enterprise

Release Notes

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Fixed issues

Splunk Enterprise 7.3.3 was released on November 18, 2019. This release includes fixes for the following issues.

Issues are listed in all relevant sections. Some issues might appear more than once. To check for additional security issues related to this release, visit the Splunk Security Portal.

Data input issues

Date resolved Issue number Description
2019-11-07 SPL-178915, SPL-171961 The datetime.xml timestamp recognition file does not recognize two-year dates after 2019 or Unix epoch-time seconds higher than 1599999999 (12:26:39 UTC 13 Sep 2020)
2019-10-23 SPL-175805, SPL-147902 (7.3.x) - Frequent renaming of splunkd.pid.tmp to splunkd.pid causing D state for process runner.

Search issues

Date resolved Issue number Description
2019-10-29 SPL-177410, SPL-176123 Subsearch getting executed during summayId generation causing an additional run of the same subsearch
2019-10-28 SPL-171904, SPL-167934 Different Search Result Between 7.2.x and 6.6.x
2019-10-25 SPL-177850, SPL-164106 export results function in the UI produces "Invalid latest_time: latest_time must be after earliest_time" message
2019-10-22 SPL-177844, SPL-178245, SPL-177971, SPL-178625 "tostring" function doesn't add a leading zero when using the duration format in 7.2.x
2019-10-18 SPL-174005, SPL-182156, SPL-175325 Search crashes on indexer in ChunkedCSVLineReader::initReader due to empty kvstore lookup folder in the bundle
2019-10-03 SPL-176557, SPL-173492 scheduled saved search delay significantly with with number of subsearches increasing
2019-10-03 SPL-176357, SPL-172516 UI is showing the incorrect endTime for tstat search
2019-10-02 SPL-174221, SPL-173445 rest query that contains a NOT no longer works in 7.3.0 but worked in 7.2.5.1.
2019-10-01 SPL-176008, SPL-166728 Alert email spacing issue
2019-09-15 SPL-173895, SPL-173452 search time increases exponentially or factorially with number of subsearches
2019-09-15 SPL-176270, SPL-176023 Lookup wildcards cannot match empty string
2019-09-15 SPL-174871, SPL-173458 Crash from multisearch command causing splunkd to crash.
2019-09-12 SPL-176114, SPL-172111 Real-Time Search Options Disabled for user role but still accessible in WebUI

Saved search, alerting, scheduling, and job management issues

Date resolved Issue number Description
2019-10-25 SPL-175380, SPL-177564, SPL-175815, SPL-177312 When alert condition is not met, scheduled searches are deferred, leading to skip searches
2019-10-18 SPL-176477, SPL-177264, SPL-177933 action.email.pdf.logo_path in savedsearches.conf doesn't work
2019-10-14 SPL-177868, SPL-175886 Creating report from alert also copies alert trigger condition settings
2019-10-10 SPL-169478, SPL-165259 Splunkd CMIndexID lock contention due to DispatchManager::getDiskUsage populating batch-retry map
2019-10-03 SPL-176557, SPL-173492 scheduled saved search delay significantly with with number of subsearches increasing
2019-10-01 SPL-176008, SPL-166728 Alert email spacing issue
2019-09-06 SPL-175484, SPL-170981 Running jobs should not be marked as expired

Charting, reporting, and visualization issues

Date resolved Issue number Description
2019-09-12 SPL-176114, SPL-172111 Real-Time Search Options Disabled for user role but still accessible in WebUI

Indexer and indexer clustering issues

Date resolved Issue number Description
2019-10-25 SPL-176730, SPL-172102 Real Time search does not warn about disconnected peers which may lead to incomplete search results
2019-10-08 SPL-176163, SPL-168257 Indexers are flapping (up or pending) due to "non-streaming failure"

Distributed search and search head clustering issues

Date resolved Issue number Description
2019-10-25 SPL-177530, SPL-174796 dispatch folder with cancel file not getting reaped
2019-10-25 SPL-176730, SPL-172102 Real Time search does not warn about disconnected peers which may lead to incomplete search results
2019-10-24 SPL-178241, SPL-176796 Corrupted Raft entry files crashes SH instance node
2019-10-21 SPL-176036, SPL-160828 DistributedPeerManager::handleConflicts needs to be improved
2019-09-30 SPL-175412, SPL-173768 phased_execution_mode=multithreaded causes overall search performance to decrease 20% - 25%, impacting mostly larger deployments having 3k+ indexers.

Universal forwarder issues

Date resolved Issue number Description
2019-10-21 SPL-177715, SPL-173094 driver certificates for splknetdrv, splunkdrv, SplunkMonitorNoHandleDrv are all showing as not valid / expired in Windows UF

Monitoring Console/DMC issues

Date resolved Issue number Description
2019-09-11 SPL-175396, SPL-173618 Servers with Custom groups in DMC are not saved to distsearch.conf

Splunk Web and interface issues

Date resolved Issue number Description
2019-10-01 SPL-176008, SPL-166728 Alert email spacing issue
2019-09-26 SPL-172753, SPL-172789 Index Selection for roles only shows 100 indexes
2019-09-24 SPL-176234, SPL-176350, SPL-176739 Lookup file Permissions displays the csv filename instead of app name
2019-09-12 SPL-176114, SPL-172111 Real-Time Search Options Disabled for user role but still accessible in WebUI
2019-09-06 SPL-175725, CV-462 Custom Visualizations Formatter Label Broken

Authentication and Authorization issues

Date resolved Issue number Description
2019-10-09 SPL-177706, SPL-174145 CSRF token failure on timeout, multiple browser tabs constantly reauthenticating
2019-09-26 SPL-172753, SPL-172789 Index Selection for roles only shows 100 indexes
2019-09-12 SPL-176114, SPL-172111 Real-Time Search Options Disabled for user role but still accessible in WebUI

Admin and CLI issues

Date resolved Issue number Description
2019-09-11 SPL-176180, SPL-159600 Clone dialog in Searches, Reports, and Alerts manager page is listing internal apps as target

Uncategorized issues

Date resolved Issue number Description
2019-10-28 SPL-176491 sessions.py HTTPDate error following upgrade to 7.2.7 on Windows 2012
2019-10-24 SPL-166696, SPL-163851 Bugcheck due to splunkdrv (WinRegMon driver)
2019-10-24 SPL-175930, SPL-172448 Added UI message for "Failed to localize" in splunkd.log
2019-10-23 SPL-175903, SPL-170982 Can not export pdf from dashboard when using wider time range
2019-10-18 SPL-174494, SPL-172641 regex_cpu_profiling not generating events on WIndows instance
2019-10-18 SPL-176538, SPL-174948 Indexers in Cluster having problems utilizing AWS storage gateway for cold storage
2019-10-17 SPL-176190, SPL-176640, SPL-178138 Count option is not working when it is set with a token
2019-10-17 SPL-177659, SPL-177953, SPL-178124 Embedding base64 image in dashboard is not displayed
2019-10-03 SPL-175600, SPL-172097 instrumentation IOStats in resource_usage.log is not being collected for some paths.
2019-09-25 SPL-171600, SPL-167453 Replicated bucket in indexer cluster is timestamped with earliest time 0 (January 1970) if its last slice is empty.
2019-09-15 SPL-174902, SPL-168635 S2: Disabling index does not roll hot buckets prior to disabling the index preventing bucket upload
2019-09-11 SPL-175398, SPL-170416 Misleading error message when uploading a bundle via Deployer
2019-09-04 SPL-175768, SPL-171220 Frequent restarting of real-time searches and bundle replication can cause memory growth in splunkd mothership
2019-09-04 SPL-175617, SPL-170099 Indexers are crashing on merging thread with CowPipelineData::appendAndReset
2019-08-26 SPL-175273, SPL-174634 $message$ token is not working for <fail> search event handler
PREVIOUS
Timestamp recognition of dates with two-digit years fails beginning January 1, 2020
  NEXT
Deprecated and removed in version 7.3

This documentation applies to the following versions of Splunk® Enterprise: 7.3.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters