What's new in Splunk 3.4

New Splunk forwarder and light forwarder applications

As of Splunk 3.4, the Splunk forwarder and light forwarder (formerly referred to as the lightweight forwarder) are now packaged with Splunk as Splunk applications that you can enable via Splunk Web or the CLI.

The Splunk light forwarder configuration removes all indexing processes, disables the file system change monitor, disables Splunk Web and the Splunk authentication subsystem, and limits some types of data input. Specifically, you can monitor local log files and directories, collect Windows event logs and use scripted inputs, including local WMI and registry data sources on Windows. If you have been waiting for a truly lightweight Splunk forwarder, this is the configuration for you.
The Splunk forwarder disables Splunk Web. All other functions and modules remain enabled.

New Splunk desktop application

The Splunk desktop application is a lighter weight version of Splunk. This configuration scales back the indexing throughput and disables the file system change monitor. This keeps Splunk from using a lot of memory and processing power on systems you use for other purposes (like laptops).

The Splunk desktop application is enabled by default if you install Splunk for Windows using the standard GUI installer. You can, of course, disable it after installation, or use the commandline MSI installation to choose a different configuration at install time, as well as install silently for use in large scripted deployments.

Read more about enabling Splunk desktop.

Support for Vista

Starting with version 3.4.2, Splunk is now supported on 32-bit Vista.

Support for 64-bit Windows

Starting with version 3.4.2, Splunk now is supported on 64-bit Windows 2003.

Receiving enabled in Splunk with a Free License

Starting with version 3.4.2, licensing in the free version of Splunk has been expanded to support the receiving feature.

Start | Next: Known Issues for release 3.4.1

Comments

No comments have been submitted.