• What's New
  • What's new in Splunk 3.2
    • Transaction search
    • Filesystem change monitoring
    • REST API
    • Windows platform support
    • Interactive event type learning
    • Interactive field extraction
    • Increased storage efficiency
    • Flexible roles
    • Auditing & signing
    • Transaction typing
    • New search features
    • Role-based search sharing
    • Live Tail
    • Dynamic event rendering
    • Universal field tagging
    • Pluggable authentication API
    • Event type templates
• Known Issues
  • Known Issues for release 3.2.3
    • General issues and considerations
    • Windows-specific considerations and known issues
    • Search issues, including deprecated commands
    • Distributed search issues and considerations
    • Splunk Web issues and considerations
    • Configuration considerations and issues
    • Splunk Toolbar considerations and issues
    • Scheduling a saved search with cron
• Changelogs by Version
  • 3.2
    • Resolved issues from 3.1.5
  • 3.2.1
    • Resolved issues from 3.2
  • 3.2.2
    • Resolved issues from 3.2.1
  • 3.2.3
    • Resolved security issues
• Credits
  • Credits
  • APSW
  • boost
  • elementree
  • expat
  • fpconst
  • gadfly
  • libarchive
  • libiconv
  • libxml2
  • libxslt
  • log4py
  • numeric
  • openLDAP
  • OpenSSL
  • pcre
  • popt1.7
  • pyopenssl
  • pysqlite
  • python
  • pyxml
  • SOAPppy 0.11.6
  • sqlite
  • twisted
  • xmlwrapp 0.5.0
  • zope
  • zlib

3.2.1

This page contains a list of issues resolved in this release of Splunk.

Resolved issues from 3.2

• An issue with multiple field extraction syntax causing splunkd to crash has been resolved.
• An issue with the cmd command causing segmentation faults has been resolved.
• An issue with forwarders mis-timestamping events into the future has been resolved.
• Non-DST timezones are now handled properly.
• An issue with parsing of _ and other capital letters in key names has been resolved.
• Editing users no longer results in a traceback.
• Highlighting of results now works correctly in distributed mode.
• An issue with the display of reporting on saved searches involving event types or tags has been resolved.
• Showing all lines now works correctly in IE.
• Specifying KV_MODE=multi is now supported correctly in props.conf.
• Timechart now uses local times for boundaries.
• Issues with rss alert notifications on Windows have been resolved.
• Saving a report in Splunk Web no longer removes reporting UI elements.
• An erroneous "unbalanced quotes" error in Splunk Web has been resolved.
• Alert scripts now take variables correctly.
• Splunk Web now recognizes non-standard database store directory locations.
• The set server-type forwarder command now works correctly.
• Windows Security events are now indexed correctly.
• Distributed search providers no longer display erroneous warnings about missing query IDs.
• Distributed search now returns complete result sets.
• The file command now sets metadata regarding source and sourcetype correctly
• RSS feeds are now displayed correctly from within Splunk Web.
• When defining key/value pairs, Splunk no longer includes quotes as part of the definition unless they are nested within an outer set of quotes. For example, key="" now defines an empty value.
• Daily indexing volume by server link now works correctly.
• Histograms saved to the dashboard now respect specified maximum event count.
• Subsearches are now supported in distributed environments.