3.4.11

3.4.11

The following issues have been resolved in this release of Splunk:

• Deployment clients will not crash when contacting a 4.x instance. (SPL-25381)
• Enabling the standard (not light) forwarder no longer disables Splunk Web. (SPL-24722)
• An issue with high CPU utilization on Windows when monitoring the registry has been resolved. (SPL-24689)
• When cloning events to multiple indexers, if an indexer becomes unavailable, the events will still be sent to the remaining indexers. (SPL-23544)
• Japanese characters are now parsed correctly in security events on Windows. (SPL-24898)
• A crash related to indexing invalid archive files has been resolved. (SPL-23088)
• The Windows version of the light forwarder is now enabled correctly when deployed using the deployment server. (SPL-23008)
• WMI events forwarded by the light forwarder now break correctly at ---splunk-wmi-end-of-event---. (SPL-22649)
• Splunk can now index uncompressed Windows evt/evtx files. Splunk on Vista, Windows 2008, Windows XP, and Windows 2003 supports uncompressed .evt files. Splunk on Vista or Windows 2008 supports uncompressed .evtx files as well. (SPL-22539)
• Functionality has been added to support indexing across very large numbers of files within a single directory when a large fraction of the files in the directory are not Splunk inputs. Use the tailing_proc_speed setting in limits.conf to tell Splunk how fast to move across non-input directory entries. Increasing this setting increases CPU usage. (SPL-18776)
• WMI instability issues have been addressed. (SPL-18394, SPL-18184, SPL-17703, SPL-17215, SPL-16714, SPL-16699, SPL-16688, SPL-16681, SPL-24851, SPL-24667, SPL-22641, SPL-20169, SPL-18393)
• LDAP bind passwords with an ampersand (&) in the string are now supported. (SPL-18170)