Splunk Changelog

What's new in Splunk 6.4.2

• New Distributed Management Console Views:
• New Distributed Management Console Views for Search Scheduler, HTTP Event Collector, Splunk TCP Performance, Distributed Search Performance, System Wide Search Performance, and System Resources I/O.
• Most of the information shown in the System Activity view in earlier versions of Splunk Enterprise is now included in Distributed Management Console views. The System Activity view is removed from this version of Splunk Enterprise.
• Custom Visualizations:
• Install visualization apps from a new visualization library on Splunkbase. Available visualizations include the following:
• Horizon chart
• Sankey diagram
• Status indicator
• Timeline
• Treemap
• These visualizations can be used instead of or in addition to the standard Splunk platform visualizations. They work with Search, Dashboards, and Reports.
• A new extensibility API is also available for partners, customers, and third party developers to create and package custom visualizations.
• Data Sampling Mode for Dashboard Searches:
• Efficiently evaluate trends and patterns using sample ratio within search.
• Tsidx Retention Policy:
• Allows customers to reduce the storage requirements for older data by approximately 50% by removing the tsidx indexing information. The data remains searchable but at a reduced performance level. The retention policy is configurable by data age per index.
• SAML Providers :
• New support for Okta, Azure AD, and ADFS.
• Indexer Cluster Enhancements:
• Option to force roll specific hot buckets. Ability to quarantine a search peer.
• Search Head Clustering Enhancements:
• Search peer replication.
• Universal Forwarder on Docker:
• Universal Forwarder is available on Docker Hub.
• Universal Forwarder support for Linux on Power Little Endian (LE):
• Universal Forwarder platform support includes Linux on Power on the Little Endian architecture.
• Additional features:
• Splunk Enterprise on-premises customers also get access for the first time to features that were introduced in the cloud-only version 6.3.1511.
• Summary Replication:
• Ability to replicate data model acceleration and report acceleration summaries on an indexer cluster.
• SAML:
• Ability to connect with Okta SAML provider.
• Log Event Alert Action:
• Ability to create a custom log event that is sent back to the Splunk platform for indexing, searching, and reporting.
• User / Role Replication:
• Ability to replicate Splunk software users and roles on a search head cluster.
• Event Sampling:
• A probabilistic sampling function for ad-hoc searches and saved reports. Use event sampling to perform quick searches to ensure the correct events are returned and to determine the characteristics of a large data set without processing every event.
• UI Control for Global Default Time Range:
• Administrators can now define a default time range value for all search pages by using a UI control in Splunk Web.
• HTTP Event Collector: Indexer Acknowledgement (Splunk Cloud self-service only):
• Allows token administrators to enable indexer acknowledgements. When enabled, clients can poll a new REST endpoint to check whether or not events have been indexed, in a secure and scalable manner.
• HTTP Event Collector: Raw Endpoint:
• A new token-based endpoint that allows customers to send raw events directly to Splunk software. Removes the need to format customer data into Splunk JSON event format. Also supports batching of events.
• HTTP Event Collector: Dedicated SSL and CORS settings:
• HTTP Event Collector now uses dedicated settings for SSL and CORS which are independent of the Splunk REST API configuration. These settings can be found in inputs.conf under the http stanza and are required for enabling SSL and CORS in Splunk Enterprise 6.4.
• Documentation Updates:
• Splunk universal forwarder documentation has moved from the Splunk Enterprise Forwarding Data manual to a new Universal Forwarder Manual in the Splunk universal forwarder documentation set. This change makes installation, upgrade, and usage information about the universal forwarder easier to find and navigate for Splunk Enterprise, Splunk Cloud, and Splunk Light customers.
• The Search Tutorial has been updated to be more clear and concise. Additionally, steps that are different between Splunk Cloud and Splunk Enterprise are highlighted.
• The spec and example files in the Admin Guide are now formatted with subheadings that enable inline navigation.
• REST API updates:
• This release includes the following new and updated REST API endpoints:
• authentication/providers/SAML
• authentication/providers/SAML/{stanza_name}
• cluster/master/control/control/roll-hot-buckets
• data/inputs/tcp/splunktcptoken
• saved/searches
• server/status/resource-usage/iostats
• Splunk Enterprise on-premises customers also get access for the first time to the following endpoints that were introduced or updated in the cloud-only version 6.3.1511:
• authorization/grantable_capabilities
• cluster/master/buckets
• cluster/config
• data/inputs/http/{name}/rotate
• data/ui/views
• data/ui/views/{name}
• services/admin/SAML-user-role-map
• services/admin/SAML-user-role-map/{name}
• services/collector
• services/collector/ack
• services/collector/event
• services/collector/mint
• services/collector/raw
• services/data/inputs/tcp/splunktcptoken
• services/data/inputs/tcp/splunktcptoken/{name}
• services/data/summaries
• services/data/summaries/{summary_name}
• services/server/status/resource-usage/iostats
• services/server/status/resource-usage/splunk-processes