Welcome to Splunk Enterprise 8.0
If you are new to Splunk Enterprise, read the Splunk Enterprise Overview. If you are familiar with Splunk Enterprise and want to explore the new features interactively, download the Splunk Enterprise Overview app from Splunkbase.
For system requirements information, see the Installation Manual.
Before proceeding, review the Known Issues for this release.
Splunk Enterprise 8.0 was first released on October 22, 2019.
Planning to upgrade from an earlier version?
If you plan to upgrade to this version from an earlier version of Splunk Enterprise, read How to upgrade Splunk Enterprise in the Installation Manual for information you need to know before you upgrade.
See About upgrading: READ THIS FIRST for specific migration tips and information that might affect you when you upgrade.
The Deprecated and removed features topic lists computing platforms, browsers, and features for which Splunk has deprecated or removed support in this release.
What's New in 8.0
|New Feature or Enhancement||Description|
|Python 3.7 support||Splunk Enterprise 8.0 introduces support for Python 3.7. You can choose to migrate scripts to Python 3.7 compatibility individually or force Python 3.7 usage across an instance.
|Workload management||Align resource allocation with business priorities through an enhanced rules framework that now includes search type, such as scheduled and ad hoc, and search mode (realtime and historical).
Increased flexibility for managing workloads during peak/off-peak hours through schedule-based rules.
See Create workload rules in the Workload Management manual.
|Analytics Workspace||Create categorical charts (line, column, area, time-column) and run analytical operations on metrics and accelerated datasets.
Add reference lines to metrics data for comparison/analysis.
Create fast and highly performant streaming alerts.
Visualize events data timeline along with metrics for root-cause analysis.
Expanded time-range picker provides better control over the data to analyze.
|Metrics performance improvements||Cost savings with optimized metrics data storage.
|Search performance improvements||Improved execution of stats command, improved memory usage and performance of lookups, and general search evaluator performance improvements.|
|Data model acceleration health stats||Additional information for the management of Data Models|
|Shared data model acceleration summaries||Ability to share data model acceleration summaries between search heads in a cluster|
|Alerting||Grouping of alerts for better performance.|
|Histogram metric datatype support||Splunk Enterprise now supports the histogram metric datatype, which enables you to bucket your metric data into a time series of histograms. You can use the new histperc macro to estimate percentile (a.k.a. quantile) values for specific time periods based on your histogram time series. See Use histogram metrics in the Metrics Manual.|
|HEC timestamp extraction||Keep event metadata (source, sourcetype, host) when ingesting event data from Apache Kafka or AWS Kinesis without the need to maintain custom parsers for things like timestamp extraction.|
|Monitoring and operability||Single pane of glass to monitor deployment-wide health without running searches. Receive alerts via Pagerduty, email, and Splunk Mobile. See Distributed health report in Monitoring Splunk Enterprise.
Install new health checks from the Health Assistant Add-on directly through the Monitoring Console. See Download health check updates in Monitoring Spunk Enterprise.
Trigger-based and simplified process for collecting diagnostics (diags/pstacks).
|Distributed search||Get up-to-date search results with faster bundle replication. See Cascading knowledge bundle replication in Distributed Search.|
|Telemetry enhancements||Enhanced telemetry collection to help optimize deployments and improve customer experience. For details about our data collection practices, see Share data in Splunk Enterprise in the Admin Manual.|
|Security enhancements||Granular access controls; within-index controls.
New user interface for Roles management.
Support for Authentication Tokens for REST API and CLI with SAML.
|Splunk Dashboards public beta||Pixel-perfect layout to fully control dashboard look and feel.
Drag-and-drop to dynamically move, layer, and resize elements.
Image and icon upload.
Download the beta app from Splunkbase.
What's New in 8.0.1
Splunk Enterprise 8.0.1 was released on December 12, 2019. It introduces the following enhancements.
Splunk Enterprise 8.0.1 fixes a significant issue with datetime.xml. See Fixed issues for more information.
|Dynamic configuration of clustering configurations||The following clustering configurations are now dynamically configurable and do not require a restart of the cluster master or indexer.
|Rolling restart enhancements for indexer cluster bundle push||Reduces the number of rolling restarts required when pushing configuration file changes to indexer cluster peers.
Splunk Enterprise 8.0 introduces additional guided data onboarding manuals that provide end-to-end guidance for getting specific data sources into specific Splunk platform deployments. You can find all the guided data onboarding manuals by clicking the Add data tab on the Splunk Enterprise documentation page.
REST API updates
This release includes these new and updated REST API endpoints.
The REST API Reference Manual describes the endpoints.
This documentation applies to the following versions of Splunk® Enterprise: 8.0.1