Splunk Cloud Platform

Release Notes

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Known and fixed issues for

This page lists selected known issues and fixed issues for this release of . Use the Version drop-down list to see known issues and fixed issues for other versions of .

See also the release notes for the Cloud Monitoring Console app and the Admin Configuration Service for their respective known and fixed issues.

Version 9.1.2312

This version includes the following known issues:

Date filed or added Issue number Description
2024-4-12 SPL-254077 CIDR match for tstats with ipv6 addresses isn't supported.

The tstats command currently doesn't filter events with CIDR match on fields that contain IPv6 addresses. Running tstats searches containing IPv6 addresses might result in the following error indicating that the addresses are treated as non-exact queries:

Error in 'TsidxStats': WHERE clause is not an exact query
2024-01-05 SPL-240774 The DELIMS setting or the kvdelim option may not be applied correctly when the k/v delim character appears 2 or more times in a field value

Perform field extractions by modifying your searches using other commands, such as the rex command or eval command.

2023-09-20 SPL-244927 Federated searches that include 'table' or 'rex' commands return 0 events when run in verbose mode.
2023-07-26 SPL-242487 Dashboard charts do not support screen reader or keyboard navigation.
2023-07-20 SPL-240969 props and transforms created with 000-self-services (000-self-services/local/transforms.conf) as the destination app get removed during sync triggered by actions such as saving rulesets in Ingest Actions.

Do not save search time field transformations to the 000-self-services app. Move the existing 000-self-services/local/transformations.conf under a different app.
2023-07-07 SPL-241821 Data Model Accelerations that have Automatic Rebuilds enabled may lead to unbounded memory growth due to search expansion, resulting in Out of Memory errors

For a data model that is experiencing high memory usage, perform the following steps:
  1. On your Splunk platform deployment, in Splunk Web, select Settings and then Data Models.
  2. Select Edit for the data model that is experiencing high memory usage, and then select Edit Acceleration.
  3. Open Advanced Settings.
  4. Disable Automatic Rebuilds.

See Accelerate data models in the Knowledge Manager Manual.

Furthermore, applying index constraints to restrict the list of indexes searched for building a given DMA summary and applying tags allowlisting would help curtail the memory usage.

2023-05-30 Not applicable ACS endpoint connections fail after June 4, 2023 or HEC sessions fail after June 14, 2023 with error messages that mention SSL, TLS, or HTTP error 503 or 525. See Cloud Platform Discontinuing support for TLS version 1.0 and 1.1.
2023-05-02 SPL-239436 In federated search, outputlookup existence check on RSH causes search to terminate early although it is not run on RSH in standard mode

Define the lookup on both federated search head and remote search head.
2023-04-24 SPL-237902 Ad hoc searches that specify earliest relative time offset assuming from 'now' should explicitly include 'latest=now' to avoid a potential time range inaccuracy.

Workaround: Ad hoc searches searches that use the earliest time modifier with a relative time offset should also include latest=now in order to avoid time range inaccuracies. For example, if you want to get all events from the last 10 seconds starting at 01:00:10, the following search returns all events that occur between the time of 01:00:00 and 01:00:10, as expected: index=main earliest=-10s latest=now.

Running the same search without including latest=now might produce unpredictable results or impact performance in certain scenarios when the search head is overloaded with ad hoc searches.

2023-04-14 SPL-238738 Federated search does not support the "Show Source" field action in either standard or transparent mode.
2023-03-14 SPL-237265 Sometimes when a search is aborted by workload rule, 'wlm_terminated' information message is not written to audit log
2022-08-23 SPL-228969 Federated Search: In Splunk Web federated index UI you cannot provide data model Dataset Name values that contain a dot ( . ) character

Workaround: This is a limitation for users of standard mode federated search who want to set up federated indexes that map to data model datasets. It means that such users cannot set up federated indexes for data model datasets that are subordinate to a root dataset. For example, if the root data model dataset is Network_Traffic, you cannot map a federated index to the subordinate data model dataset Network_Traffic.All_Traffic.

As a workaround, users can run tstats searches that use the nodename argument to filter out data that does not belong to a specific data model dataset: | tstats ... where nodename=Network_Traffic.All_Traffic.

2022-07-29 SPL-227633 Error : Script execution failed for external search command 'runshellscript'

The setting precalculate_required_fields_for_alerts=0 can be set on saved searches that have no other alert actions attached aside from the "Run A Script" action, to quash the error. For saved searches that have multiple alert action attached, this may not be safe as it will disable back propagation of required fields for all alert actions, which might result in the parent search extracting more fields than required, which could negatively impact performance for that search.
2022-06-15 SPL-226877 Federated Search UI Error: Cannot create saved search dataset for federated index if dataset name contains space

Workaround: Use REST API to create the federated saved search instead:
curl -k -u <username>:<password> -X POST https://localhost:8089/servicesNS/nobody/search/data/federated/index -d name=federated:index_kathy -d federated.dataset='savedsearch:ss with space' -d federated.provider=remote_deployment_1.
See Federated search endpoint descriptions in the REST API Reference Manual.

2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Use another browser such as Chrome or Firefox

This version fixes the following issues:

Date filed or added Issue number Description
2024-01-24 SPL-249100 WLM rules using numeric search_time_range predicate not honoring earliest and latest time modifiers for some user roles when launching search via curl command.
2023-05-10 SPL-239808 For customers on Google Cloud Platform (GCP), Splunk Secure Gateway does not work. All features including device management and registration are not functional.
2023-04-28 SPL-239339 Workload Management ignores Place in Pool action.
Last modified on 12 April, 2024
What's new
Splunk Cloud Platform Field alias behavior change

This documentation applies to the following versions of Splunk Cloud Platform: 9.1.2312

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters