• What's New
  • What's new in Splunk 3.3
    • Summary Indexing
    • Application browser and manager
    • Continuous crawling
    • Windows Registry input
    • WMI input
    • New directory structure and nomenclature for custom bundles/applications
    • New developer tools
• Known Issues
  • Known Issues for release 3.3.4
    • General issues and considerations
    • Search issues, including deprecated commands
    • Splunk Web issues and considerations
    • Windows-specific considerations and known issues
    • Distributed search issues and considerations
    • Configuration considerations and issues
    • Splunk Toolbar considerations and issues
    • API considerations and issues
  • Workaround for SSL configuration for users of Firefox 3
    • Background
    • Symptoms
    • Workaround
• Changelogs by Version
  • 3.3
  • 3.3.1
    • Windows-specific issues
  • 3.3.2
  • 3.3.3
    • Windows-specific issues
  • 3.3.4
• Credits
  • Credits
  • APSW
  • boost
  • elementree
  • expat
  • fpconst
  • gadfly
  • libarchive
  • libiconv
  • libxml2
  • libxslt
  • log4py
  • numeric
  • openLDAP
  • OpenSSL
  • pcre
  • popt1.7
  • pyopenssl
  • pysqlite
  • python
  • pyxml
  • SOAPppy 0.11.6
  • sqlite
  • twisted
  • xmlwrapp 0.5.0
  • zope
  • zlib

3.3.2

The following issues have been resolved in this release of Splunk:

• File system change monitor no longer follows symlinks in /etc when followlinks is set to false. (SPL-16089)
• File system change monitor is now correctly disabled when disabled=true (instead of only when the entire stanza in inputs.conf is deleted). (SPL-15017)
• Splunk now properly indexes files when they are deleted and recreated with the same name. (SPL-16139)
• Various crashes have been addressed. (SPL-16002, SPL-15933, SPL-15150, SPL-14958, SPL-14546)
• Splunk's indexing processes now more aggressively throttle and address optimization issues (SPL-14552)
• An issue with display of graphs in dashboards has been resolved (SPL-15923)
• An issue with chart selection being honored has been resolved. (SPL-14870)
• 24-hour timestamps that include AM/PM information are now handled correctly. (SPL-15688)
• Saved searches that include a chart now retain the specified chart type. (SPL-15616)
• Timechart now functions correctly in distributed search. (SPL-15514)
• If a user clicks on a link that kicks off a search, and this search does not include explicit time terms, the UI now runs that search in All Time rather than the default time range, which matches what happens in dashboard searches. (SPL-15509)
• Application browsing will no longer generate a stack trace if splunkbase.com is unresolvable. (SPL-15505)
• The splunk set deploy-poll and deploy-multicast commands now accept dns names. (SPL-15396)
• An issue with the time picker not being reset correctly has been resolved. (SPL-15364)
• Setting blockSignSize = 100 in indexes.conf will no longer prevent event data from being displayed in Splunk Web. (SPL-15253)
• host_segment and host_regex now work correctly for data in archives. (SPL-15235)
• Searching for the text of a name=value pair in an event now works correctly. (SPL-15225)
• The interactive field extractor now handles unicode events correctly, (SPL-15222)
• Timestamping issues for native windows event logs are now human readable. (SPL-15066)
• Changing the number of warm buckets in limits.conf to a number lower than you actually have no longer causes issues with searching. (SPL-15060)
• An issue with menu displays in the Admin Splunk Web interface has been resolved. (SPL-15000)
• Sinkhole settings are no longer editable via Splunk Web, only through configuration files. (SPL-14868)
• Splunk Web now correctly validates entries for index name. (SPL-15698)