• Overview
  • What's New in Splunk 2.1
    • Home Page
    • Search Results
    • Tags
    • Admin Panels
    • Splunk-2-Splunk
    • Saved Splunks & Live Splunks
    • Time Range Selection
• Changelogs by Version
  • Release Notes 2.2.1
    • New Features
    • Resolved Issues
    • Known Issues
  • Release Notes 2.2
    • New Features
    • Resolved Issues
    • Known Issues
  • Release Notes 2.1.3
    • New Features
    • Resolved Issues
    • Known Issues
  • Release Notes 2.1.2
    • Warning - Updating from 2.1.x
    • New Features
    • Resolved Issues
    • Known Issues
  • 2.1.1 Release Notes
    • New Features
    • Resolved issues
    • Known Issues
  • 2.1 GA Release
    • New Features since 2.0
    • Resolved Issues since 2.1b2
  • 2.1 Beta 2 Release Notes
    • WARNING: Don't Upgrade 2.0 Servers Yet
    • New Features
    • Known Issues
    • Resolved issues
  • 2.1 Beta 1 Release Notes
    • WARNING: Don't Upgrade 2.0 Servers Yet
    • New Features
    • Known Issues
  • Release Notes Archive

Release Notes 2.2.1

Date of Release: April 11, 2007

Splunk 2.2.1 resolves several issues identified in the 2.2 release.

To install Splunk 2.2.1, see the Installation Manual for full instructions.

New Features

• XFS support

The Splunk Server now supports the XFS filesystems on linux. For a complete list of supported filesystems please check here

Resolved Issues

• Upgrading from 2.1.x to 2.2.1 no longer requires a user migration.
• Resolved various crashes attributed to our UTF8 processor.
• Resolved a deadlock issue attributed to Splunk's use of SQLlite.
• Resolved crashes attributed to searching for meta events.
• Corrected the "Last refreshed" time displayed in the upper left-hand corner to work properly with the recent Daylight Savings change.
• Corrected a problem with Splunk's LDAP connection management such that authentication stopped working if the LDAP server times out the connection.

Known Issues

• If the Splunk Server is configured to use LDAP authentication, the amount of time required for Splunk to successfully start will be in direct relation to the number of users stored in the LDAP. Startup can take anywhere between 45-60 seconds.
• LDAP authentication should not use SSL
• When participating in distributed search the report::[ ] operator will need to be enclosed in quotes
• The GroupDN cannot contain an ampersand (&) character if you are configuring LDAP from the GUI. The workaround is to edit the auth.conf file directly.
• Restarting Splunk before a Live Splunk runs for the first time will result in 12/31/1969 being displayed as the Next Run date. This is purely cosmetic, the Live Splunk will run at the scheduled interval.
• An ampersand (&) in the user's Splunk password (e.g., "ch&ngeme") causes an authorization failure for Live Splunks. If you intend to use Live Splunks, choose a password without &.
• We have seen issues migrating 2.1.x users on FreeBSD to 2.2.1. If you are running Splunk on FreeBSD and lose your users on upgrade please contact Splunk Support for assistance in recovering your users.