3.2.2

3.2.2

This page contains a list of issues resolved in this release of Splunk.

Resolved issues from 3.2.1

• Splunk now calculates index size correctly. The directory size calculations Splunk performs when starting up now include raw data, and so many now take a little longer to complete if you have a large amount of data the first time you start Splunk. (SPL-12933)
• An issue with Splunk crashing at startup in timezones with non-DST offsets (GMT) has been resolved. (SPL-13072)
• Issues with mishandling of non-standard HTTP return codes have been addressed (SPL-12976, SPL-12960)
• Splunk no longer uses an inefficient memory allocator for Solaris installs. (SPL-12958)
• The oldsearch delete command now correctly deletes items regardless of whether you use it in Splunk Web or the CLI, but the IDs of the deleted items are not displayed if you use the command in Splunk Web. (SPL-13078)
• The metadata processor and access to the typeahead help can now be restricted to users based on their role. Refer to authorize.conf for details about the get_metadata and get_typeahead options. (SPL-13009, SPL-13007)
• Canceling searches across distributed hosts now works correctly. (SPL-12956)
• Using the localize search command without arguments no longer crashes splunkd. (SPL-12806)
• Searching for indexed fields with capital letters in the name now functions correctly. (SPL-12800)
• Clicking a field tab to open, then again to close no longer clears the fields picker. (SPL-12758)
• It is now possible to restart Splunk via Splunk Web even if a user response is required; ./splunk restart --answer-yes functions as expected. (SPL-12623)
• Splunk Web now correctly reflects that distributed search is enabled when you enable it. (SPL-11937)