• What's New
  • What's new in Splunk 3.3
    • Summary Indexing
    • Application browser and manager
    • Continuous crawling
    • Windows Registry input
    • WMI input
    • New directory structure and nomenclature for custom bundles/applications
    • New developer tools
• Known Issues
  • Known Issues for release 3.3.1
    • General issues and considerations
    • Windows-specific considerations and known issues
    • Search issues, including deprecated commands
    • Distributed search issues and considerations
    • Splunk Web issues and considerations
    • Configuration considerations and issues
    • Splunk Toolbar considerations and issues
  • Workaround for SSL configuration for users of Firefox 3
    • Background
    • Symptoms
    • Workaround
• Changelogs by Version
  • 3.3
  • 3.3.1
    • Windows-specific issues
• Credits
  • Credits
  • APSW
  • boost
  • elementree
  • expat
  • fpconst
  • gadfly
  • libarchive
  • libiconv
  • libxml2
  • libxslt
  • log4py
  • numeric
  • openLDAP
  • OpenSSL
  • pcre
  • popt1.7
  • pyopenssl
  • pysqlite
  • python
  • pyxml
  • SOAPppy 0.11.6
  • sqlite
  • twisted
  • xmlwrapp 0.5.0
  • zope
  • zlib

3.3.1

The following issues have been resolved in this release of Splunk.

• The Power user role now allows use of Live Tail. (SPL-15337)
• Configuration files deployed by the Deployment server to /usr/local now properly take precedence over other configuration files. (SPL-15204)
• Permissions for directories created by the Linux .rpm installation are now set correctly. (SPL-15198)
• Correct time is now displayed on AIX systems when not using Daylight Savings Time. (SPL-15114)
• An issue with data crossover between indexes when using the summary indexing feature has been resolved. (SPL-14936)
• Splunk now logs all successful login attempts rather than just the first one. All logout and login failure continue to be logged correctly. (SPL-14960)
• The User role can no longer add schedules to existing saved searches. (SPL-14867)
• Piping a search to timechart and sorting results according to tag value now works correctly. (SPL-14850)
• Debian package installation now completes correctly. (SPL-14934)
• The Back button now functions correctly when viewing reports. (SPL-14283, SPL-10705)
• Splunk no longer crashes if you fail to specify a valid value for groupNameAttribute ( = cn) in authentication.conf when configuring an LDAP server. (SPL-13562)
• An issue with columns not being sorted correctly when you have only one row of results has been resolved. (SPL-14810)
• Distributed search now functions correctly across indexes. (SPL-14807)
• Splunk's LDAP integration now correctly handles spaces in a dn definition. (SPL-14718)
• XML output for REST endpoint queries against search results now displays full set of results. (SPL-14701)
• The file system change monitor feature now displays file permissions in octal rather than hex. (SPL-14352)
• Round-robin forwarding configuration now functions correctly when one of the Splunk servers stops and restarts. (SPL-13673)
• The $SPLUNK_HOME/share/splunk/search_oxiclean/rss directory permissions on install have been corrected so RSS feeds can be created. (SPL-10695)

Windows-specific issues

• Multiple issues with migration from earlier versions of Splunk for Windows have been resolved. (SPL-14906)
• An issue with display of dashboards on reload of main Splunk Web page has been resolved. (SPL-15027)
• Changing the user Splunk runs as now works. (SPL-14871)
• Saving a search using the drop-down menu now correctly saves the alert properties for the alert. (SPL-14753)
• Splunk Alerts now support .bat scripts. (SPL-15012)
• The Message field is now extracted correctly in Windows Event Logs. (SPL-15064, SPL-15063)
• The ComputerName field is now displayed correctly for all Windows Event Logs. (SPL-15056)
• The SourceName is now extracted correctly for Windows Event Logs. (SPL-15055)
• Custom values for host set in inputs.conf are no longer overwritten by localhost. (SPL-14997)
• Custom values of index set in indexes.conf are now honored. (SPL-14996)