Welcome to Splunk Enterprise 9.0
If you are new to Splunk Enterprise, read the Splunk Enterprise Overview.
For system requirements information, see the Installation Manual.
Before proceeding, review the Known Issues for this release.
Splunk Enterprise 9.0 was released on June 14, 2022.
Planning to upgrade from an earlier version?
If you plan to upgrade to this version from an earlier version of Splunk Enterprise, read How to upgrade Splunk Enterprise in the Installation Manual for information you need to know before you upgrade.
See About upgrading: READ THIS FIRST for specific migration tips and information that might affect you when you upgrade.
The Deprecated and removed features topic lists computing platforms, browsers, and features for which Splunk has deprecated or removed support in this release.
What's New in 9.0
|New Feature or Enhancement||Description|
|Ingest Actions||A new user interface that enables admins to quickly author, preview, and deploy ingest-time rules for filtering, masking, and routing events. See Use Ingest Actions to improve the data input process.
|Splunk Assist||Splunk Assist brings the power of Splunk Cloud Platform management insights to self-managed Splunk Enterprise deployments to analyze and continually evaluate security posture, alerting administrators with cloud-powered recommendations to change configurations and make necessary updates to Splunkbase apps to enhance security. |
Splunk Assist is a fully managed cloud service that provides deep insights into the security posture of Splunk Enterprise deployments. Customers can apply configuration best practices that are consistent with how Splunk manages Splunk Cloud Platform for some of the largest and most complex deployments. See About Splunk Assist.
|Indexer cluster manager redundancy||To achieve cluster manager high availability, you can deploy two or more cluster managers in an active/standby configuration. You can configure the managers to support either automatic or manual failover. See Implement cluster manager redundancy.|
|SmartStore support for Azure||Support for SmartStore using Azure Blob service. This support integration will help Splunk Enterprise customers looking for Azure as part of their multi cloud delivery option. See SmartStore system requirements.|
|Role-based field filtering (Preview feature)||Control who can see your sensitive data. Use field-level filtering and obfuscation at search-time to limit access to confidential information for certain roles by redacting or obfuscating fields in events within searches. See Protecting PII and PHI data with role-based field filtering.|
|Migrate KV store storage engine and server version from 3.6.x to 4.2||To take advantage of the most up-to-date KV Store in this latest release, Splunk Enterprise 9.0 comes with a set of tools to guide the upgrade of your KV store server version to v4.2, as well as the migration of your KV Store storage engine. These updates are required in Splunk Enterprise 9.0. See Migrate the KV store storage engine in the Admin manual to plan your migration.|
|Upgrade Readiness App version 4.0.0||Splunk Enterprise 9.0.0 includes version 4.0.0 of the Upgrade Readiness App. See About the Upgrade Readiness App.|
|Integrate jQuery into Upgrade Readiness App||The Upgrade Readiness App now provides jQuery and Python 3 support to keep all apps working appropriately in future Splunk versions when old libraries are deprecated. Cloud admins can request new default Python versions within the Upgrade Readiness App. The Upgrade Readiness App is the newest version of the Python Upgrade Readiness App shipped in previous releases.|
|Configuration Change Tracker index||Splunk Enterprise enables you to track .conf file changes at the filesystem level with the new index _configtracker. The new auditing capability includes the tracking of .conf files, as well as their underlying stanzas and key-value pairs, to improve root cause analysis and troubleshooting. See Configuration Change Tracker in the Troubleshooting Manual.|
|Upgrade of default TSIDX compression level||For improved performance and reduced storage, the default |
|TSIDX compression for SmartStore indexes||This feature adds a flag to enable compression of TSIDX files for SmartStore indexes. TSIDX files will be compressed and stored in AWS S3 using the zstd format. TSIDX files will be uncompressed when downloading from AWS. This feature is intended to reduce storage costs and network costs and improve search times. See Compress tsidx files upon upload to S3.|
|Configure health report email alerts in Splunk Web||This enhancement enables admins to setup Health Report email alerts using the Splunk Web user interface. See Set up health report alert actions in the Monitoring Splunk Enterprise manual.|
|Health Report config tuning||Health Report includes new indicators that are based on customer issues that were caused by inaccurate config parameters. The new indicators alert you to potential configuration issues so you can correct them before they become problems.|
|Monitor forwarder ingestion latency in health report||The ingestion latency feature in the health report lets admins monitor whether forwarders in their distributed Splunk Enterprise deployment have fallen behind due to ingestion latency. The "Ingestion Latency Reported" status is displayed in the Splunk health report. For more information, see Supported features in the Monitoring Splunk Enterprise manual.|
|Health Report updates||Health Report is updated with the following usability improvements:
|Bucket Merge functionality for clustered peer instances||Cluster peer performance and stability increasingly suffers as the number of buckets increases. Additionally, several activities like service restarts can cause a side effect of multiplication of small buckets. The new cluster-merge-buckets command provides a self-service capability for administrators to manage the merging of buckets. See cluster-merge-buckets in Command line tools for use with Support in the Troubleshooting Manual.|
|Dashboard Studio||Dashboard Studio has several enhancements this release, such as setting tokens from search results or search job status, passing tokens from one dashboard to the next, and new cluster maps. For a comprehensive list of new features and enhancements, see What's new in Dashboard Studio in the Splunk Dashboard Studio manual.|
|Dashboards: Bulk migration from
||Users can now update their dashboard visualizations with one click. These updated visualizations provide greater flexibility and configurability.|
|Dashboards: Block access to inline style sheets||Users now receive a message to reference external style sheets instead of inline styles in Simple XML dashboards for improved maintainability.|
|Restriction of jQuery 2 libraries||Administrators can now restrict vulnerable jQuery libraries using a toggle available in the Settings UI. Note that restricting these libraries does not require a Splunk restart. See Control access to jQuery and other internal libraries.|
|Audit improvements for knowledge objects||This feature enhances the existing auditing framework to provide customers with insights on the lifecycle of knowledge objects |
|Federated Search for Cloud to OnPrem deployments||Enables customers to get insights across Splunk Cloud and On-prem Splunk deployments with search initiated from Splunk Cloud.|
|Federated Search enhancements to improve hybrid-to-federated migration experience - Transparent mode||Introduces transparent mode federated providers, which allow existing hybrid search customers to migrate smoothly to federated search. See Migrate from hybrid search to federated search.|
|Federated search UI enhancements||This release includes the following enhancements to the Federated Search UI:
See About federated search.
|Federated search support for data model datasets, data model acceleration, and the
||Enables federated searches over data model datasets in both standard and transparent mode. You can now use the |
|Federated search command enhancements for Standard mode||Federated searches can now use the |
|Federated search Consent UI plan||Enables customers to leverage federated search with compliant environments. Added checkboxes to the UI that require administrators to acknowledge that enabling federated search from deployments with lower regulatory compliance to deployments with higher regulatory compliance might compromise that compliance. See Service accounts and federated search security and Define a federated provider.|
|Replacement of existing MMDB file shipped with Splunk Enterprise||With the release of Splunk Enterprise 9.0, the default provider and associated lookup file for the "iplocation" search command has changed. If you use the "iplocation" command with the "allfields=true" option, you will see a difference in the output fields. Both "Timezone" and "MetroCode" fields are removed. As an alternative, customers may upload and use their self-licensed MMDB file, provided it is in a compatible format of MMDB.|
|Enhancements to the
||Now in addition to obtaining search results across multiple fields in each result row, you can use the |
|Automatic setup of assets in monitoring console||The monitoring console now features an option to automatically build and maintain the list of assets (nodes) for representation in the monitoring console, especially as assets are added and evicted. |
See Enable automatic distributed mode configuration in Monitoring Splunk Enterprise.
|Update to Splunk Secure Gateway App||Splunk Secure Gateway lets you manage your Connected Experiences (Splunk Mobile & Splunk AR) mobile app deployments and register devices to a Splunk instance. With the latest updates to Splunk Secure Gateway, we've given you the ability to unlock admin insights, configure your region and highly customize your mobile experience. In addition, we've made it even easier to register and manage your connected devices.|
|Semantic versioning of APIs||New Semantic Versioned endpoints of the Search API are being introduced to improve platform contracts and resiliency to platform updates. A deprecation period will be announced to allow customers to update the usage of these endpoints to the new API version.|
|Universal forwarder: Collect MacOS Unified Logging data||Universal forwarder supports the new log sources standard for MacOS using the logd input. See Forward data with the logd input.|
|Universal forwarder: Configuration changes are logged by default||The |
|Universal forwarder: Managed Service Accounts supported for Windows installations||During CLI installations, you can now specify a Managed Service Account (MSA) name or Group Managed Service Account (gMSA) name. See Install the universal forwarder in low-privilege mode.|
|Universal forwarder: Automatic password generation support for Windows installations.||Universal Forwarder for Windows now provides the option to automatically generate a password at installation time. See Install a Windows universal forwarder from an installer.|
|Universal forwarder: Least-privileged user creation for Linux installations||By default, the universal forwarder installer creates a least-privileged user. The least-privileged user runs as non-root user with the minimum necessary privileges needed to manage the universal forwarder. See Secure your Linux universal forwarder by installing in least privileged mode.|
|Universal forwarder: limit access to port 8089 by default||The default setting for |
|Workload Management: Ad hoc search quota control
||You can now create admission rules to limit the number of concurrent ad hoc searches, which can help to ensure that search slots remain available for critical scheduled searches. |
See Configure admission rules to prefilter searches in the Workload Management manual.
|Workload Management: Enhanced wildcard support in workload rules||This enhancement gives you more flexibility when creating workload rules and admission rules by adding wildcard support for the following predicates: |
See Configure workload rules in the Workload Management manual.
|Risky commands restrictions||New |
|New ipmask(<mask>,<IP>) conversion function||This function generates a new masked IP address by applying a mask to an IP address through a bitwise |
|Removed biased language||Biased language has been removed from the licensing components of Splunk Enterprise, in keeping with Splunk's commitment to equality in our actions and products.
What's New in 18.104.22.168
Splunk Enterprise 22.214.171.124 was released on July 20, 2022. It resolves the issue described in Splunk Enterprise 126.96.36.199 Fixed issues.
What's New in 9.0.1
Splunk Enterprise 9.0.1 was released on August 16, 2022. It delivers relevant fixes described in the August 16, 2022 quarterly security patch on the Splunk Product Security page. This release also introduces the following enhancements and resolves the issues described in Fixed issues.
|Ingest Actions enhancements|
|Dashboards: Warn users when they are leaving Splunk via custom URL drilldown||For improved security, users are now prompted to acknowledge any time they're being redirected to a link outside of their deployment.|
What's New in 9.0.2
Splunk Enterprise 9.0.2 was released on November 1, 2022.
|New Feature or Enhancement||Description|
|Ingest Actions multiple S3 bucket destinations||Ingest Actions now supports routing to more than one S3 destination. The creation of a maximum of four S3 destinations is currently supported.|
|Ingest Actions S3 output configuration without rolling restart||Ingest Actions supports creating, editing, and deleting a new S3-compliant destination without triggering a rolling restart (indexer clustering bundle push).|
|Common access card (CAC) / Personal Identity Verification (PIV) authentication||CAC/PIV authentication is natively supported on Splunk Enterprise version 9.0.2 and higher search heads. See Configure Splunk Enterprise to use a common access card for authentication.|
What's New in 9.0.3
Splunk Enterprise 9.0.3 was released on December 14, 2022.
|New Feature or Enhancement||Description|
|New flag to enable translation of user content.||A new flag in web-features.conf enables translation of user content in Simple XML dashboards.|
|Warning for use of S2S V3 or lower.||Warning for use of S2S V3 or lower.|
|Migration script to update Search & Reporting v=null dashboards to v=1.1||When Splunk is upgraded or starts up, update Simple XML dashboards in the Search & Reporting app with no version attribute to v=1.1.|
This documentation applies to the following versions of Splunk® Enterprise: 9.0.3