Welcome to Splunk Enterprise 8.0
If you are new to Splunk Enterprise, read the Splunk Enterprise Overview. If you are familiar with Splunk Enterprise and want to explore the new features interactively, download the Splunk Enterprise Overview app from Splunkbase.
For system requirements information, see the Installation Manual.
Before proceeding, review the Known Issues for this release.
Splunk Enterprise 8.0 was first released on October 22, 2019.
Planning to upgrade from an earlier version?
If you plan to upgrade to this version from an earlier version of Splunk Enterprise, read How to upgrade Splunk Enterprise in the Installation Manual for information you need to know before you upgrade.
See About upgrading: READ THIS FIRST for specific migration tips and information that might affect you when you upgrade.
The Deprecated and removed features topic lists computing platforms, browsers, and features for which Splunk has deprecated or removed support in this release.
What's New in 8.0
|New Feature or Enhancement||Description|
|Python 3.7 support||Splunk Enterprise 8.0 introduces support for Python 3.7. You can choose to migrate scripts to Python 3.7 compatibility individually or force Python 3.7 usage across an instance.
|Workload management||Align resource allocation with business priorities through an enhanced rules framework that now includes search type, such as scheduled and ad hoc, and search mode (realtime and historical).
Increased flexibility for managing workloads during peak/off-peak hours through schedule-based rules.
See Create workload rules in the Workload Management manual.
|Analytics Workspace||Create categorical charts (line, column, area, time-column) and run analytical operations on metrics and accelerated datasets.
Add reference lines to metrics data for comparison/analysis.
Create fast and highly performant streaming alerts.
Visualize events data timeline along with metrics for root-cause analysis.
Expanded time-range picker provides better control over the data to analyze.
See About the Analytics Workspace in the Analytics Workspace manual.
|Metrics performance improvements||Cost savings with optimized metrics data storage. Includes the ability to have multiple measurements per metric data point.
See Overview of metrics in Metrics.
Wildcard functionality for logs2metrics.
See Set up ingest-time log-to-metrics conversion in Splunk Web in Metrics.
|Search performance improvements||Improved execution of stats command, improved memory usage and performance of lookups, and general search evaluator performance improvements.|
|Data model acceleration health stats||Additional information for the management of Data Models
See Manage data models in the Knowledge Manager Manual.
|Shared data model acceleration summaries||Ability to reuse existing data model acceleration summaries from search heads and search head clusters leveraging the same set of indexers.
See Share data model acceleration summaries among search head clusters in the Knowledge Manager Manual.
|Alerting||Grouping of alerts for better performance.|
|Histogram metric datatype support||Splunk Enterprise now supports the histogram metric datatype, which enables you to bucket your metric data into a time series of histograms. You can use the new histperc macro to estimate percentile (a.k.a. quantile) values for specific time periods based on your histogram time series. See Use histogram metrics in the Metrics Manual.|
|HEC timestamp extraction||Customers who directly use the HEC API to ingest data can now directly use HEC timestamp extraction when they update to 8.0. The HEC endpoint |
|Monitoring and operability||Single pane of glass to monitor deployment-wide health without running searches. Receive alerts via Pagerduty, email, and Splunk Mobile. See Distributed health report in Monitoring Splunk Enterprise.
Install new health checks from the Health Assistant Add-on directly through the Monitoring Console. See Download health check updates in Monitoring Spunk Enterprise.
Trigger-based and simplified process for collecting diagnostics (diags/pstacks).
|Distributed search||Get up-to-date search results with faster bundle replication. See Cascading knowledge bundle replication in Distributed Search.|
|Telemetry enhancements||Enhanced telemetry collection to help optimize deployments and improve customer experience. For details about our data collection practices, see Share data in Splunk Enterprise in the Admin Manual.|
|Security enhancements||Granular access controls; within-index controls.
New user interface for Roles management, including the ability to clone roles. See Create and manage roles with Splunk Web.
Support for Authentication Tokens for REST API and CLI with SAML.
|Splunk Dashboards public beta||Pixel-perfect layout to fully control dashboard look and feel.
Drag-and-drop to dynamically move, layer, and resize elements.
Image and icon upload.
Download the beta app from Splunkbase.
Splunk Enterprise 8.0 introduces additional guided data onboarding manuals that provide end-to-end guidance for getting specific data sources into specific Splunk platform deployments. You can find all the guided data onboarding manuals by clicking the Add data tab on the Splunk Enterprise documentation page.
REST API updates
This release includes these new and updated REST API endpoints.
The REST API Reference Manual describes the endpoints.
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0
Feedback submitted, thanks!