Splunk® Enterprise

Release Notes

This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Fixed issues

Splunk Enterprise 9.2.1 was released on March 27, 2024. This release includes fixes for the following issues. It also delivers relevant updates from the 2024-03-27 Security Advisories list.

Issues are listed in all relevant sections. Some issues might appear more than once.

Data input issues

Date resolved Issue number Description
2024-02-29 SPL-251749, SPL-249543 TcpInputProcessor not able to drain splunktcpin queue during graceful shutdown
2024-02-28 SPL-249543, SPL-251748, SPL-251749, SPL-253929, SPL-251746, SPL-253927, SPL-253928 TcpInputProcessor not able to drain splunktcpin queue during graceful shutdown.
2024-02-21 SPL-251251, SPL-241076 Metrics event can be indexed in default event index when mcollect is used.
2024-01-17 SPL-249424, SPL-249409 Splunk UF (windows) huge amount of duplicating logs due to re-reading log file after Upgrade to 9.1.0.1

Federated search issues

Date resolved Issue number Description
2024-03-06 SPL-248312, SPL-242049 Kvstore files are not converted to csv files in the bundles when local indexers are not present even when remote providers are present

Charting, reporting, and visualization issues

Date resolved Issue number Description
2024-02-13 SPL-249098, SPL-247587 After upgrading to 9.1.1 dashboards iframe panels load to a blank page
2023-11-08 SPL-244788, SPL-247096, SPL-247097 "Awaiting user confirmation" error when img src is a token that is set to a URL after SXML dashboard loads

Indexer and indexer clustering issues

Date resolved Issue number Description
2024-02-29 SPL-251749, SPL-249543 TcpInputProcessor not able to drain splunktcpin queue during graceful shutdown
2024-02-28 SPL-249543, SPL-251748, SPL-251749, SPL-253929, SPL-251746, SPL-253927, SPL-253928 TcpInputProcessor not able to drain splunktcpin queue during graceful shutdown.

Universal forwarder issues

Date resolved Issue number Description
2024-03-21 SPL-248587, SPL-252796, SPL-252797 Unable to install or upgrade to Splunk Universal Forwarder version 9.1.3
2024-02-23 SPL-251517, SPL-237849 CHECK_METHOD = modtime not working as expected in ver. 9.0.4 upgrading from 8.2.7.
2023-11-09 SPL-246709, SPL-245467 Global OPENSSL_CONF Env caused pre-flight check failure during installation

Monitoring Console issues

Date resolved Issue number Description
2024-02-01 SPL-249851, SPL-244687 Bucket Health Status is not cleared even after 24 hours until a new bucket is created

Splunk Web and interface issues

Date resolved Issue number Description
2023-11-20 SPL-247205, SPL-246389 splunkcore-web-ui browserify-sign to 4.2.2

Uncategorized issues

Date resolved Issue number Description
2024-02-29 SPL-250493, SPL-235583 Metadata files inside buckets can be corrupted and left unsearchable.
2023-12-13 SPL-248188, SPL-248140 Slow indexer detection calculate send queue bytes
2023-11-17 SPL-246640 web.conf server.socket_host no longer overrides splunk-launch.conf SPLUNK_BINDIP
Last modified on 21 June, 2024
Field alias behavior change   Deprecated and removed in version 9.2

This documentation applies to the following versions of Splunk® Enterprise: 9.2.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters