Known Issues

Updated for maintenance release 3.0.1.

General

Splunk 3.0 requires Flash 9. You can verify what version of Flash you are running here.
Internet Explorer 6 is known to occasionally display the SplunkWeb pages incorrectly. Internet Explorer 7 fixes this issue and correctly displays SplunkWeb pages.
Automated migration from 2.x to 3.0.x is currently not supported. For instructions on manual migration see the Upgrading from 2.x versions section of our Installation manual.
The file properties.xml ships with the product, but its settings have no effect. Use props.conf to alter Splunk's settings.

Reports require Adobe Flash, and run best in the latest version, currently Flash 9 (download). Flash is available for Firefox 1.5 and 2.0, and Internet Explorer 6 and 7. See the Adobe (Flash system requirements) .
Exporting all events on a Mac can result in a exception being returned on screen.
When using UDP for your data input we have seen instances where the hostname in the event gets rewritten as garbled text.
Some Linux users (particularly SUSE 10.x) aren't getting dialog boxes displayed correctly and searches return the message "Unable to get a properly formatted response from the server; canceling the current search." This is a problem with the mime.types configuration. See this forum post for details: http://www.splunk.com/base/forum:SplunkGeneral/656/2452.
Shared saved searches aren't displaying in other users' dashboards if you are using LDAP. You can still access them from the drop-down menu next to the search box with the "Saved Searches" submenu.
When in Distributed Search mode multi-line events are being rendered as a single line events.
Having too many roles set might cause searching to suffer a performance loss.
SplunkWeb is only capable of displaying 499 groups when configuring LDAP.
- For configuring more than 499 groups, manually configure them by editing auth.conf.
The search command outputcsv doesn't output fields in the correct order.
Alerts do not work correctly in distributed search mode.
Sharing a dashboard report to other users currently doesn't work.

The command splunk export globaldata results in an exception.
Using delete:: on sources can crash splunkd.
Using delete:: multiple times on the same source/host/sourcetype (particularly removing all events) can cause bizarre event counts.
Adding a forwarding server via SplunkWeb sometimes reports an odd error message.
If you move the location of your datastore by changing SPLUNK_DB in setSplunkEnv, the path $SPLUNK_HOME/var/lib/splunk/searches must still exist. If it doesn't, Splunk won't find your index.
If you edit setSplunkEnv to change the SPLUNK_DB value, do not leave a commented-out line. If there is more than one instance of the string "SPLUNK_DB" in the file, SplunkWeb may incorrectly display your datastore path.

2.0.x licenses will not work with 3.0. If you have a current Plus Support contract you are entitled to upgrade your license to 3.0. If you do not have a current support agreement in place please contact sales@splunk.com.

Export and import of user data may not work properly.
In the deployment server, the 'default' class is supposed to target *all* deployment clients; unfortunately, configuration files placed in the default directory on the deployment server do not get pushed properly.
Splunk doesn't always recognize timestamps correctly for IronPort logs.
Attempting to move from a free license to an evaluation license via SplunkWeb may result a webserver exception being displayed on screen. If you encounter this error you can apply the license by hand. Instructions on how to perform this operation can be found here.
Using the Manage Saved searches menu drop down will open a new window that does not take you to the correct location. The main browser window will need to be refreshed in order to see your dashboard and perform a search.
The following admin searches currently do not work
- admin deployment
- admin eventdiscoverer
- admin fieldactions
- admin metaevents
- admin metrics
- admin modules
- admin outputs
- admin user-seed
- admin breakers

Toolbar sometimes displays two drop-down arrows in the search box.
Toolbar cannot yet get past the "Welcome to Splunk" initial page that comes up when running without a license, or when running with a free license, and no web session has been established.
Performing a lookup on SplunkBase from the toolbar will 404.
We have received reports of searches from the toolbar not returning results, causing the browser to hang. These same searches will work if run directly from the server.
We have received reports that the Splunk toolbar will prevent "Find in this page" functionality from running multiple times on the same page. These reports have been limited to users running multiple browser add-ons (e.g. colorful tabs, dom inspector, user agent switcher).
Autologin does not work if the Autologin is set to off prior to configuring your server in the toolbar. If you want to be able to login automatically first turn on this feature in the toolbar prior to configuring the server.

Previous: What's new in Splunk 3.0 | Next: 3.0.1

No comments have been submitted.