Fixed issues

Splunk Enterprise 8.1.1 was released on December 8, 2020. This release includes fixes for the following issues.

Issues are listed in all relevant sections. Some issues might appear more than once. To check for additional security issues related to this release, visit the Splunk Security Portal.

Authentication and authorization issues

Date resolved	Issue number	Description
2020-11-18	SPL-197656, SPL-196712	list_indexer_cluster cannot see the cluster info from the UI
2020-10-28	SPL-194287, SPL-190298	SAML - unable to update idpCerts via idpCertChain text box in SHC with replicate certificates enabled
2020-10-28	SPL-196619, SPL-195586	Linux 7.2.4.2 SHC + Duo Security 2FA - Authentication - login fails when using a custom root_endpoint

Upgrade issues

Date resolved	Issue number	Description
2020-11-23	SPL-197918, SPL-195414	Custom Navigation Menus Lost When Upgrading Splunk from 7.3.6 to 7.3.7
2020-11-16	SPL-196757, SPL-197069, SPL-197599	Upgrading CM to 8.1 breaks indexer discovery hence stops CM/forwarders forwarding logs to indexers
2020-10-28	SPL-194816, SPL-192191	Splunk Enterprise upgrade from version 7.x to 8.0.3 fails due to authentication.conf being encoded as Unicode/UTF-16LE

Search issues

Date resolved	Issue number	Description
2020-12-07	SPL-197414, SPL-197990	Searches are not working (crash in Main Thread) after upgrade (LDAP/SAML authentication)
2020-11-23	SPL-196223, SPL-193845	Bucket that rolled during search execution contained events missing from results
2020-11-23	SPL-196900, SPL-194112	Cascading replication aborted for peer=Peer_URI:8089 with bundle status = bundle_initialized after a retry attempt
2020-11-18	SPL-196187, SPL-195733	Indexer Crashes due to an assert failure in TSIDX postings offset region
2020-11-16	SPL-196856, SPL-196528	Post 7.3.4 upgrade issue: dashboard "jumping" on dropdown selection
2020-11-16	SPL-196846, SPL-195638	Dashboard dev - PostProcessManager does not work when its managerid is another PostProcessManager after upgrade
2020-11-12	SPL-197193, SPL-194016	search optimizer causing some search condition to be missing in remote search for searches including multiple wildcarded terms for the same field
2020-10-29	SPL-195273, SPL-193747	Benign console errors while loading Area chart - "TypeError: this.hcSeries.graph is undefined" or "TypeError: Cannot read property 'attr' of undefined" console error
2020-10-28	SPL-196390, SPL-194368	Linux 8.0.3 autoloadbalanced SHC + IDX cluster - Admin Cli - many random searches are crashing after upgrade
2020-10-28	SPL-194276, SPL-191472	Getting Security ID value equal to NONE_MAPPED for Member for the EventCode = 4732
2020-10-28	SPL-195123, SPL-193949	search process throws exception with "ERROR SearchEvaluatorBasedExpander - Caught exception during filter to index expansion - unbalanced parentheses"
2020-10-26	SPL-194961, SPL-194790	Reached limit max_mem_usage_mb error not appearing in UI
2020-10-25	SPL-194540, SPL-193073, SPL-193598	reverse lookup shows inconsistent behaviors
2020-10-24	SPL-196216, SPL-196190	"|rest" search with "strict" option fails to run when there are search peers with version less than 8.0.5.

Saved search, alerting, scheduling, and job management issues

Date resolved	Issue number	Description
2020-10-28	SPL-194597, SPL-194014	getMgmtUri shouldn't include stderr in the results.

Charting, reporting, and visualization issues

Date resolved	Issue number	Description
2020-12-07	SPL-197414, SPL-197990	Searches are not working (crash in Main Thread) after upgrade (LDAP/SAML authentication)
2020-11-23	SPL-196223, SPL-193845	Bucket that rolled during search execution contained events missing from results
2020-11-23	SPL-196900, SPL-194112	Cascading replication aborted for peer=Peer_URI:8089 with bundle status = bundle_initialized after a retry attempt
2020-11-18	SPL-196187, SPL-195733	Indexer Crashes due to an assert failure in TSIDX postings offset region
2020-11-16	SPL-196856, SPL-196528	Post 7.3.4 upgrade issue: dashboard "jumping" on dropdown selection
2020-11-16	SPL-196846, SPL-195638	Dashboard dev - PostProcessManager does not work when its managerid is another PostProcessManager after upgrade
2020-11-12	SPL-197193, SPL-194016	search optimizer causing some search condition to be missing in remote search for searches including multiple wildcarded terms for the same field
2020-10-29	SPL-195273, SPL-193747	Benign console errors while loading Area chart - "TypeError: this.hcSeries.graph is undefined" or "TypeError: Cannot read property 'attr' of undefined" console error
2020-10-28	SPL-196390, SPL-194368	Linux 8.0.3 autoloadbalanced SHC + IDX cluster - Admin Cli - many random searches are crashing after upgrade
2020-10-28	SPL-194276, SPL-191472	Getting Security ID value equal to NONE_MAPPED for Member for the EventCode = 4732
2020-10-28	SPL-195123, SPL-193949	search process throws exception with "ERROR SearchEvaluatorBasedExpander - Caught exception during filter to index expansion - unbalanced parentheses"
2020-10-26	SPL-194961, SPL-194790	Reached limit max_mem_usage_mb error not appearing in UI
2020-10-25	SPL-194540, SPL-193073, SPL-193598	reverse lookup shows inconsistent behaviors
2020-10-24	SPL-196216, SPL-196190	"|rest" search with "strict" option fails to run when there are search peers with version less than 8.0.5.

Indexer and indexer clustering issues

Date resolved	Issue number	Description
2020-11-16	SPL-196757, SPL-197069, SPL-197599	Upgrading CM to 8.1 breaks indexer discovery hence stops CM/forwarders forwarding logs to indexers
2020-10-27	SPL-194093, SPL-193066	Deserialization failed. val for key=indexing_disk_space is not a valid unsigned long long number.
2020-10-22	SPL-196334, SPL-194863	During indexer cluster searchable rolling restart, indexer was stuck in ReassigningPrimaries

Distributed search and search head clustering issues

Date resolved	Issue number	Description
2020-11-04	SPL-196636, SPL-193341	Linux 7.2.9 SHC - Admin Cli - all SHC members receiving a Deployer bundle with a modified master_uri lose all CM knowledge prior to restart
2020-10-29	SPL-194964, SPL-193571	SHC Captain number of threads kept increasing to over 8000; searches stopped;due to deadlock in CascadingBundleReplicationProvider code
2020-10-25	SPL-194627, SPL-194186	Some search been paused for a period of time - Process delayed by X seconds, perhaps system was suspended

Distributed deployment, forwarder, deployment server issues

Date resolved	Issue number	Description
2020-11-19	SPL-197229, SPL-196194	All App from Deployment Server UI show "Unchanged from state on deployment server"

Splunk Web and interface issues

Date resolved	Issue number	Description
2020-10-28	SPL-194276, SPL-191472	Getting Security ID value equal to NONE_MAPPED for Member for the EventCode = 4732
2020-10-22	SPL-194819, SPL-188395, SPL-194413	WebUI is not Returning Proper Bundle Validation-Restart check when there is a "Not Critical" error

Admin and CLI issues

Date resolved	Issue number	Description
2020-11-11	SPL-194053, SPL-193257	create_context=usr: notify mothership for newly created file
2020-11-04	SPL-196636, SPL-193341	Linux 7.2.9 SHC - Admin Cli - all SHC members receiving a Deployer bundle with a modified master_uri lose all CM knowledge prior to restart

Uncategorized issues

Date resolved	Issue number	Description
2020-11-18	SPL-195749, SPL-195523	Scripts started via the dash shell missing from resource_usage.log.
2020-11-10	SPL-197009, SPL-195826	splunkd.exe is constantly crashing by Access violation, cannot read at address
2020-11-04	SPL-194562, SPL-169676	Splunkd does not properly terminate, after permission issue with server.pem during startup.
2020-10-30	SPL-196707, SPL-195411	Redundant absent summary cachemanager open calls
2020-10-28	SPL-196249, SPL-195427	logs2metrics regex for value (dimension) only allows for some characters
2020-10-28	SPL-194542, SPL-192261	Incorrect date when the event is more than 3 hours from previous one
2020-10-26	SPL-194575, SPL-191298	Excess bucket removal process getting stuck when unstable buckets are not deleted due to being missing in CacheManager