Known Issues

Updated for maintenance release 3.0.2

General

Splunk 3.0 requires Flash 9. You can verify what version of Flash you are running here.
Internet Explorer 6 is known to occasionally display the SplunkWeb pages incorrectly. Internet Explorer 7 fixes this issue and correctly displays SplunkWeb pages.
Automated migration from 2.x to 3.0.x is currently not supported. For instructions on manual migration see the Upgrading from 2.x versions section of our Installation manual.
The file properties.xml ships with the product, but its settings have no effect. Use props.conf to alter Splunk's settings.

Search & Navigation

Reports require Adobe Flash, and run best in the latest version, currently Flash 9 (download). Flash is available for Firefox 1.5 and 2.0, and Internet Explorer 6 and 7. See the Adobe (Flash system requirements).
Exporting all events on a Mac can result in a exception being returned on screen.
Some Linux users (particularly SUSE 10.x) aren't getting dialog boxes displayed correctly and searches return the message "Unable to get a properly formatted response from the server; canceling the current search." This is a problem with the mime.types configuration. Instructions on how to correct this problem can be found here.
Using the eval operator causes all of the fields to be shown in the event but not in the field tabs.
When creating an eventtype with custom eventtypetag, the UI does not display the eventtypetag unless you edit and save the eventtype again.
Some search queries may be very slow to return. You can, however, make UI search faster with three changes.
The format command doesn't accept nil (), The workaround is to append " " "(" "AND" ")" " ".
Using delete:: multiple times may cause irrational event counts. If you have this problem, contact support for more info. Otherwise, avoid using delete:: until this is resolved.
The "Create new dashboard" item in the Dashboard drop-down menu is not currently working. This is corrected for 3.1, contact support for the workaround.
Having too many roles set might cause searching to suffer a performance loss.
SplunkWeb is only capable of displaying 499 groups when configuring LDAP.
- For configuring more than 499 groups, manually configure them by editing auth.conf.
The search command outputcsv doesn't output fields in the correct order.
Typo in init scripts. The first line should read #! /bin/sh.
White/black listing does not work.
A manual sourcetype for a gzipped input file may not be respected.
Alerts do not work correctly in distributed search mode.
Sharing a dashboard report to other users currently doesn't work.

Administration

Adding a forwarding server via SplunkWeb sometimes reports an odd error message.

2.0.x licenses will not work with 3.0. If you have a current Plus Support contract you are entitled to upgrade your license to 3.0. If you do not have a current support agreement in place please contact sales@splunk.com.

Export and import of user data may not work properly.
In the deployment server, the 'default' class is supposed to target *all* deployment clients; unfortunately, configuration files placed in the default directory on the deployment server do not get pushed properly.
Splunk doesn't always recognize timestamps correctly for IronPort logs.
Attempting to move from a free license to an evaluation license via SplunkWeb may result a webserver exception being displayed on screen. If you encounter this error you can apply the license by hand. Instructions on how to perform this operation can be found here.
Splunk's authentication module cannot work with Domino LDAP.
LDAP authSettings values may not contain a space (for example, use "My_AD" rather than "My AD". (Note that this item may not be "LDAP".).
LDAP configurations that use the same attribute for more than one item in auth.conf (like groupMemberAttribute and realNameAttribute both "cn") may fail. This will be corrected for 3.1.
The following admin searches currently do not work:
- admin deployment
- admin eventdiscoverer
- admin fieldactions
- admin metaevents
- admin metrics
- admin modules
- admin outputs
- admin user-seed
- admin breakers

Toolbar

Toolbar sometimes displays two drop-down arrows in the search box.
Toolbar cannot yet get past the "Welcome to Splunk" initial page that comes up when running without a license, or when running with a free license, and no web session has been established.
Performing a lookup on SplunkBase from the toolbar will 404.
In some cases, searches from the toolbar not returning results, causing the browser to hang. These same searches will work if run directly from the server.
In some cases, the Splunk toolbar will prevent "Find in this page" functionality from running multiple times on the same page. These reports have been limited to users running multiple browser add-ons (e.g. colorful tabs, dom inspector, user agent switcher).
Autologin does not work if the Autologin is set to off prior to configuring your server in the toolbar. If you want to be able to login automatically first turn on this feature in the toolbar prior to configuring the server.
The toolbar does not have a mechanism for alerting if its credentials are invalid. Users should verify that their credentials are correct if your Splunk server is configured to talk to an LDAP server that locks accounts after N failed login attempts.
We have seen reports of the toolbar commandeering a user session if it is configured to talk to a Splunk instance other than the one the user is currently logged in to.

Platforms

The 3.0.2 AIX release will run work with AIX 5.2 and AIX 5.3 with IY91530 and IY93744 fixes installed. The commands to see if these fixes have been applied:

/usr/sbin/instfix -ik IY91530
/usr/sbin/instfix -ik IY93744

Previous: What's new in Splunk 3.0 | Next: 3.0.2

Comments

No comments have been submitted.