DEFAULT SPLUNK LOGIN LICENSE
No warning message is displayed when a license violation is committed.Setting the default app for user or role from Splunk Web fails because Splunk creates the setting under the wrong stanza.The Indexing Volume view in the Search app has been improved to include a license volume dashboard.Column order not kept in email attachment.Fields referenced in a subsearch do not get extracted.Off by one error involving the earliest time in the dataset when searching across multiple indexes.Search failure should not assume “0 events”. Alert errantly triggered when “Streamed search execute failed”.Real-time search falls behind when handling thousands of events when the time window is >30 seconds.Inconsistent results in distributed search environment due to receive Timeout requires display of error in Splunk Web.The “outputlookup” search command doesn’t work if var/run/ is on a different volume from etc/apps.Equality comparisons do not work on _time field.Scheduled search doesn’t show events/results in RSS feed or on dashboard, but if you look at recent job artifacts, there are events/results.| crawl doesn’t work from the commandline because it’s passed an invalid sessionKey.Can’t export csv results when viewing search artifacts.When you save a top or rare search with the argument showperc, the showperc argument disappears when you run the search.The audit.log contains random search_ids for saved searches that have been run manually.Searching through a bucket with one or more events in the distant future (such as 2012) can cause no results to be returned unless ‘over all time’ is selected.When running several searches in parallel, subsearches in append sometimes die.All arguments past first arg are dropped on resurrect.
Resurrection issue (saved searches, dashboards) with searches that use | sort with multiple arguments.A subsearch’s maxresult is limited by ’s maxresults setting in nf.HTML results in email alerts does not properly sort fields.Summary search is executed with different search string when runs from the scheduler or from Splunk Web.If you are running Splunk Free, remote access via the CLI is disabled by default and allowRemoteLogin must be set to always to allow remote login. If you are running Splunk Enterprise and have not changed the default password, remote login is disabled by default for the admin user. A new configuration option, allowRemoteLogin has been added to nf to disallow remote CLI and REST API login access by default.The following issues have been resolved in this release of Splunk: Splunk provides the ability for users to search, monitor and analyze live streaming IT data as well as terabytes of historical data, all from the same interface.
0 kommentar(er)
