Splunk® Supported Add-ons

Splunk Add-on for Linux

Release notes for the Splunk Add-on for Linux

Version 2.1.0 of the Splunk Add-on for Linux was released on July 25, 2022.

Compatibility

Version 2.1.0 of the Splunk Add-on for Linux is compatible with the following software, CIM versions, and platforms:

Splunk platform version 8.1.x, 8.2.x, 9.0.x
CIM 5.0.1
Supported OS for data collection Linux
Vendor products Red Hat 7.8, Red Hat 8.5, Red Hat 8.6, CentOS 7, CentOS Stream 8.2015, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, SUSE 15 SP3, Debian 9, Debian 10.9, Debian 11.

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

Upgrade

Follow the installation instructions to upgrade an existing installation of the Splunk Add-on for Linux. See Install the Splunk Add-on for Linux.

No data migration is required to upgrade the Splunk Add-on for Linux from version 2.0.0 to version 2.1.0.

New features

Version 2.1.0 of the Splunk Add-on for Linux has the following new features.

  • Support for CIM v 5.0.1
  • Support for Ubuntu v22.04 and Red Hat v8.6 OS
  • Added the linux_audit_endpoint_services eventtype for SERVICE_START and SERVICE_STOP audit logs.
  • Removed the extraction for user=unset for type=USER_LOGIN in the audit logs.


Fixed issues

Version 2.1.0 of the Splunk Add-on for Linux has the following, if any, fixed issues. If no issues appear below, no issues have yet been reported:


Known issues

Version 2.1.0 of the Splunk Add-on for Linux contains the following known issues. If no issues appear below, no issues have yet been reported:


Third-party software attributions

Version 2.1.0 of the Splunk Add-on for Linux does not incorporate any third-party software or libraries.

Last modified on 01 September, 2022
When to use the Splunk Add-on for Linux   Release history for the Splunk Add-on for Linux

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters