• What's New
  • What's new in Splunk 3.0
    • Interactive reporting
    • Dashboards and personalization
    • Expanded search language
    • Flexible event typing
    • Scripted inputs
    • 64-bit support
    • Multi-processor support
    • Deployment server
    • Advanced data management
    • SplunkBase 3.0
    • Browser toolbar
    • Other features and improvements
• Known Issues
  • Known Issues
    • General
    • Search & Navigation
    • Administration
    • Toolbar
    • Platforms
• Changelogs by Version
  • 3.0.2
    • New features
    • Resolved issues from 3.0.1
  • 3.0.1
    • New features
    • Resolved issues from 3.0
    • New issues in this release
  • 3.0
    • New features
    • Resolved issues from 3.0 beta 3
    • New issues in this release
  • 3.0 Beta 3
    • New features
    • Resolved issues from 3.0 beta 2
    • New issues in this release
  • 3.0 Beta 2
    • New features
    • Resolved issues from 3.0 beta 1
  • 3.0 Beta 1
    • New features
    • Resolved issues from 2.2.3
• Credits
  • Credits
  • APSW
  • boost
  • elementree
  • expat
  • fpconst
  • gadfly
  • libarchive
  • libiconv
  • libxml2
  • libxslt
  • log4py
  • numeric
  • openLDAP
  • OpenSSL
  • pcre
  • popt1.7
  • pyopenssl
  • pysqlite
  • python
  • pyxml
  • SOAPppy 0.11.6
  • sqlite
  • twisted
  • xmlwrapp 0.5.0
  • zope
  • zlib

3.0.2

New features

• Users can now bundle python scripts that can be accessed via the REST API
• SplunkBase 3.0 is now live
• Splunk now runs on AIX

Resolved issues from 3.0.1

• The command splunk export globaldata no longer results in an exception
• Username strings are now properly XML-escaped
• Redefining $SPLUNK_DB will no longer cause events to appear to vanish in SplunkWeb
• Small files are now tailed properly (will not re-read them continuously)
• Added support in the database management system to be able to move data across partitions on WORM devices
• Fixed issue in SplunkWeb dashboard with the Daily index volume displaying incorrectly
• RPM package update from 3.x will no longer remove the local configuration
• Tail processor now supports the option to work as if performing tail -f
• Fixed LDAP crash issue with (> 1000 users for non-AD servers)
• Long saved search names no longer run off the drop-down menu in SplunkWeb
• Deleting events while search is still running no longer causes error in event count
• Fixed bug in admin tab of SplunkWeb with saving searches
• Fixed bug in SplunkWeb when changing sourcetype of TCP input from manual to automatic
• Added support for telling a user what access control limits apply to him/her
• Specifying a time range in SplunkWeb no longer overrides the SplunkWeb controls for timerange
• Added functionality to dashboard panes in SplunkWeb - 'x' in upper right corner of each dashboard pane now causes the pane to be removed permanently
• Alerts now work with saved searches containing less than and greater than symbols ( <, >)
• Fixed issue with source:: not accepting capital letters in paths to extracted fields
• LDAP logins are no longer case-sensitive
• Fixed issue with UDP data inputs where the hostname in an event gets written as garbled text
• Saved searches now display in other user's dashboards when using LDAP
• delete:: on sources no longer causes splunkd to crash
• Using delete:: multiple times on the same source/host/sourcetype no longer creates errors in event counts
• Added support for the CLI command export to be able to handle event data
• Fixed "Malformed XML or SOAP" exception on License & Usage tab when license exceeded (see Cannot access License & Usage tab for details.)