• What's New
  • What's new in Splunk 3.1
    • Form search
    • Search language simplification
    • Archiving
• Known Issues
  • Known Issues for release 3.1.3
    • General Issues and Recommendations
    • Search & Navigation
    • Administration
    • Toolbar
• Changelogs by Version
  • 3.1.3
    • Resolved issues from 3.1.2
    • New issues in this release
  • 3.1.2
    • Resolved issues from 3.1.1
    • New issues in this release
  • 3.1.1
    • New features
    • Resolved issues from 3.1
    • New issues in this release
  • 3.1
    • New features
    • Resolved issues from 3.0.x
    • New issues in this release
• Credits
  • Credits
  • APSW
  • boost
  • elementree
  • expat
  • fpconst
  • gadfly
  • libarchive
  • libiconv
  • libxml2
  • libxslt
  • log4py
  • numeric
  • openLDAP
  • OpenSSL
  • pcre
  • popt1.7
  • pyopenssl
  • pysqlite
  • python
  • pyxml
  • SOAPppy 0.11.6
  • sqlite
  • twisted
  • xmlwrapp 0.5.0
  • zope
  • zlib

3.1.1

New features

• 64-bit Free BSD is now supported.

Resolved issues from 3.1

• OSX dmg install no longer incorrectly sets the file permissions to the default license file.
• The 64-bit RPM install no longer sets incorrect file permissions for /opt/splunk/share. They are now set to 755 (was previously set to 555).
• Power users can now create saved searches that are globally shared.
• Adding a forwarding server via SplunkWeb will no longer occassionally cause an error message to be displayed.
• Moving from a free license to an evaluation license will no longer cause a webserver exception to be displayed while in SplunkWeb.
• While in SplunkWeb, clicking on a tag next to an eventtype now adds the correct syntax of "eventtypetag=" to your search.
• The followTail option in inputs.conf now functions as expected.
• References to Splunk-2-cool, Splunk-2-Nagio were removed the Splunk binary and moved to SplunkBase where thay can be downloaded as add-ons.
  • Spunk-2-Netcool add-on
  • Splunk-2-Nagios add-on
• Fixed typos in some of the init scripts.
• Fixed anomaly where a long path name in props.conf causes splunkd to crash.
• Fixed cosmetic issue in SplunkWeb where text would change positions when adding multiple tags.
• Alerts now work in distributed search.
• Mousing over dashboards now correctly displays a cursor hand in SplunkWeb.
• You can now share dashboards with other users.
• Default permissions in native packages are now more secure.
• Pressing "ctrl-R" now correctly refreshes SplunkWeb.
• The "lines per event" setting now is persisted with other user preferences.
• The directory monitor now correctly crawls directories.
• Changed the default values of settings in indexes.conf to allow you to tune Splunk to more efficiently use system resources.
  • maxQueryIds = <non-negative number> now has an increased default value of 10000000.
  • maxResults = <non-negative number> now has a default of 50000. It is recommended to set this key to 50000 for 32-bit systems, and 500000 for 64-bit systems.
• Added the key to indexes.conf: maxConcurrentOptimizes = <number of concurrent optimize processes that can be run>, to allow you the ability to change the number of concurrent optimize processes that can be run against the hot shard. You should increase the number if there are always many small tsidx files in hot, or when there are many tsidx files in warm and cold after a roll. the default for this key is 3.
• Added the key to indexes.conf: waitForOptimize = < 0 = no, !0 = yes >, to allow you the ability to control whether or not to let kill optimize processes during a roll. If you are seeing pauses in your indexing and searching, set this key to 0. The default for this key is 0.

New issues in this release

• In a distributed search cluster, it is recommended that you have every node upgraded to an identical version of Splunk.
  • If you are using LDAP authentication you must update every node in a distributed search cluster to 3.1.1 if you want distributed search to work. You cannot mix 3.1.1 and 3.1 nodes because of an access control fix.
  • You can mix 3.1 and 3.1.1 in a distributed search cluster if you are using Splunk's standard authentication.