Skip to main content Back to Top
Splunk Cloud Platform™

Release Notes

Acrobat logo Download manual as PDF

Splunk Cloud Platform™

9.0.2208 (latest release)
Acrobat logo Download topic as PDF

Known and fixed issues for Splunk Cloud Platform

This page lists selected known issues and fixed issues for Splunk Cloud Platform.

See also the release notes for the Cloud Monitoring Console app and the Admin Configuration Service for their respective known and fixed issues.


Version 9.0.2205

This version includes the following known issues:

Date filed or added Issue number Description
2022-07-27 SPL-227530 Splunk-to-Splunk federated search: After upgrade, the remote search head gets stuck in a loop of transferring proxy bundles to the remote indexers and failing.

Workaround: To stop a proxy bundle (pb_t1) from being sent endlessly from the remote deployment to it's indexers, you need to ensure that the local deployment generates a new bundle. Once this one new bundle is generated and sent to the remote deployment (as (pb_t2), the remote deployment will stop sending the previous bundle to the indexers.

To make sure that happens:

  1. There must be a valid transparent mode federated provider definition that connects the local deployment to the remote deployment that keeps sending the proxy bundle.
  2. You can create a dummy tag on the local deployment to trigger the bundle replication from the local deployment to the remote deployment.
2022-06-15 SPL-226877 Federated Search UI Error: Cannot create saved search dataset for federated index if dataset name contains space

Workaround: Use REST API to create the federated saved search instead:
curl -k -u <username>:<password> -X POST https://localhost:8089/servicesNS/nobody/search/data/federated/index -d name=federated:index_kathy -d federated.dataset='savedsearch:ss with space' -d federated.provider=remote_deployment_1.
See Federated search endpoint descriptions in the REST API Reference Manual.

2022-03-17 SPL-220932 On the Classic Experience, private app upload fails without any error message even when the AppInspect field check_that_app_passes_slim_validation_for_cloud triggers a warning.

Workaround:
Validate with AppInspect report that this check (check_that_app_passes_slim_validation_for_cloud) is triggering a warning. Address the warning to pass this section. Errors are typically related to SLIM and the manifest file(s) packaged within the app.
2022-02-25 SPL-219793 Some commands in federated searches return incorrect resultCount values when run in Verbose mode

Workaround:
Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode.

2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-02-08 SPL-218842 Some reporting commands in federated search return incorrect eventCount

Workaround:
Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode.

2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following issues:

Date filed or added Issue number Description
2022-08-19 SPL-223193 "Open in Search" function doesn't work with chained searches in Dashboard Studio when the time range depends on an input/token, showing error "Invalid earliest_time"
2022-07-21 SPL-227163 Frequent disable and enable updates of ssg_enable_modular_input causes search head instability and configuration file replication delays.

Workaround: Disable the splunk_secure_gateway app.

Version 8.2.2203

This version includes the following known issues:

Date filed or added Issue number Description
2022-08-19 SPL-223193 "Open in Search" function doesn't work with chained searches in Dashboard Studio when the time range depends on an input/token, showing error "Invalid earliest_time"
2022-07-27 SPL-227530 Splunk-to-Splunk federated search: After upgrade, the remote search head gets stuck in a loop of transferring proxy bundles to the remote indexers and failing.

Workaround: To stop a proxy bundle (pb_t1) from being sent endlessly from the remote deployment to it's indexers, you need to ensure that the local deployment generates a new bundle. Once this one new bundle is generated and sent to the remote deployment (as (pb_t2), the remote deployment will stop sending the previous bundle to the indexers.

To make sure that happens:

  1. There must be a valid transparent mode federated provider definition that connects the local deployment to the remote deployment that keeps sending the proxy bundle.
  2. You can create a dummy tag on the local deployment to trigger the bundle replication from the local deployment to the remote deployment.
2022-07-21 SPL-227163 Frequent disable and enable updates of ssg_enable_modular_input causes search head instability and configuration file replication delays.

Workaround: Disable the splunk_secure_gateway app.

2022-06-15 SPL-226877 Federated Search UI Error: Cannot create saved search dataset for federated index if dataset name contains space

Workaround: Use REST API to create the federated saved search instead:
curl -k -u <username>:<password> -X POST https://localhost:8089/servicesNS/nobody/search/data/federated/index -d name=federated:index_kathy -d federated.dataset='savedsearch:ss with space' -d federated.provider=remote_deployment_1.
See Federated search endpoint descriptions in the REST API Reference Manual.

2022-03-17 SPL-220932 On the Classic Experience, private app upload fails without any error message even when the AppInspect field check_that_app_passes_slim_validation_for_cloud triggers a warning.

Workaround:
Validate with AppInspect report that this check (check_that_app_passes_slim_validation_for_cloud) is triggering a warning. Address the warning to pass this section. Errors are typically related to SLIM and the manifest file(s) packaged within the app.
2022-02-25 SPL-219793 Some commands in federated searches return incorrect resultCount values when run in Verbose mode

Workaround:
Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode.

2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-02-08 SPL-218842 Some reporting commands in federated search return incorrect eventCount

Workaround:
Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode.

2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following issues:

Date filed or added Issue number Description
2022-05-02 SPL-223508 When trying to load a Studio dashboard, the page shows "Splunk Cloud is currently under maintenance."
2022-01-19 SPL-217505 Federated searches fail when table command is used

Workaround:
Fix a federated search that runs into this issue by appending | noop search_optimization.replace_table_with_fields=f to the search string.

Version 8.2.2202

This version includes the following known issues:

Date filed Issue number Description
2022-08-19 SPL-223193 "Open in Search" function doesn't work with chained searches in Dashboard Studio when the time range depends on an input/token, showing error "Invalid earliest_time"
2022-06-15 SPL-226877 Federated Search UI Error: Cannot create saved search dataset for federated index if dataset name contains space

Workaround: Use REST API to create the federated saved search instead:
curl -k -u <username>:<password> -X POST https://localhost:8089/servicesNS/nobody/search/data/federated/index -d name=federated:index_kathy -d federated.dataset='savedsearch:ss with space' -d federated.provider=remote_deployment_1.
See Federated search endpoint descriptions in the REST API Reference Manual.

2022-05-02 SPL-223508 When trying to load a Studio dashboard, the page shows "Splunk Cloud is currently under maintenance."

Workaround:

  • Restarting the search head fixes the issue temporarily.
  • A more permanent workaround is to set set enforce_dashboards_csp=false under the [settings] stanza in etc/system/local/web.conf. After changing this setting, a restart will be required to take effect.
2022-03-17 SPL-220932 On the Classic Experience, private app upload fails without any error message even when the AppInspect field check_that_app_passes_slim_validation_for_cloud triggers a warning.

Workaround:
Validate with AppInspect report that this check (check_that_app_passes_slim_validation_for_cloud) is triggering a warning. Address the warning to pass this section. Errors are typically related to SLIM and the manifest file(s) packaged within the app.
2022-02-25 SPL-219793 Some commands in federated searches return incorrect resultCount values when run in Verbose mode

Workaround:
Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode.

2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-02-08 SPL-218842 Some reporting commands in federated search return incorrect eventCount

Workaround:
Use Verbose and Smart mode specifically for searches with transforming commands like stats, chart, and timechart, and then review the results in the Statistics tab. To review event counts, run non-transforming searches in Fast mode.

2022-01-19 SPL-217505 Federated searches fail when 'table' command is used

Workaround:
Fix a federated search that runs into this issue by appending `| noop search_optimization.replace_table_with_fields=f` to the search string.
2021-12-22 PAPP-23255 In version 4.1.73 of Phantom App on Splunk, there is an erroneous error message when syncing workbooks. The sync performs successfully, but upon completion, the error message states that the sync failed. You can safely ignore this error message. A fix will be included in the next GA release of Phantom App on Splunk.
2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following issue:

Date filed Issue number Description
2022-03-17 SPL-220924 On the Victoria Experience, the Uploaded Apps UI page fails to load if a Splunk managed app is uploaded with same Id and version number through the self-service UI.

Workaround:
Contact Splunk Support to reinstall the app

Version 8.2.2201

This version includes the following known issues:

Date filed Issue number Description
2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-01-19 SPL-217505 Federated searches fail when 'table' command is used

Workaround:
Fix a federated search that runs into this issue by appending `| noop search_optimization.replace_table_with_fields=f` to the search string.
2021-12-22 PAPP-23255 In version 4.1.73 of Phantom App on Splunk, there is an erroneous error message when syncing workbooks. The sync performs successfully, but upon completion, the error message states that the sync failed. You can safely ignore this error message. A fix will be included in the next GA release of Phantom App on Splunk.
2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following issue:

Date filed Issue number Description
2021-09-02 SPL-211648 In transparent mode, federated search with eventtype and macro is not applied to remote deployment search head

Version 8.2.2112

This version includes the following known issues:

Date filed Issue number Description
2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-01-19 SPL-217505 Federated searches fail when 'table' command is used

Workaround:
Fix a federated search that runs into this issue by appending `| noop search_optimization.replace_table_with_fields=f` to the search string.
2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-09-02 SPL-211648 In transparent mode, federated search with eventtype and macro is not applied to remote deployment search head
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following issue:

Date filed Issue number Description
2021-12-03 SPL-215861 EPS drops after upgrade as a result of default 50k export cap in limits.conf.

Version 8.2.2111

This version includes the following known issues:

Date filed Issue number Description
2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-01-19 SPL-217505 Federated searches fail when 'table' command is used

Workaround:
Fix a federated search that runs into this issue by appending `| noop search_optimization.replace_table_with_fields=f` to the search string.
2021-12-03 SPL-215861 EPS drops after upgrade as a result of default 50k export cap in limits.conf.
2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-09-02 SPL-211648 In transparent mode, federated search with eventtype and macro is not applied to remote deployment search head
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following Issues:

Date filed Issue number Description
2021-10-21 SPL-213892 Splunkbase apps installed via self-service cannot be upgraded in Victoria Experience version 8.2.2109.

The following error message appears: An error occurred while installing the app:400

Version 8.2.2109

This version includes the following known issues:

Date filed Issue number Description
2022-02-22 SPL-219540 outputlookup command in a federated search creates output on RSH
2022-01-19 SPL-217505 Federated searches fail when 'table' command is used

Workaround:
Fix a federated search that runs into this issue by appending `| noop search_optimization.replace_table_with_fields=f` to the search string.
2021-12-03 SPL-215861 EPS drops after upgrade as a result of default 50k export cap in limits.conf.
2021-10-21 SPL-213892 Splunkbase apps installed via self-service cannot be upgraded in Victoria Experience version 8.2.2109.

The following error message appears: An error occurred while installing the app:400

2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-09-02 SPL-211648 In transparent mode, federated search with eventtype and macro is not applied to remote deployment search head
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following Issues:

Date filed Issue number Description
2021-08-12 SPL-210244 No default value selected on radio buttons in Simple XML dashboards
2021-08-05 SPL-209879 Unable to upload private apps in .tar.gz format on Victoria Experience.

Workaround:
Upload the app in .tar format

Version 8.2.2107

This version includes the following known issues:

Date filed Issue number Description
2021-12-03 SPL-215861 EPS drops after upgrade as a result of default 50k export cap in limits.conf.
2021-10-21 SPL-214005 Victoria Experience self-service app install: Lookups deployed by apps cannot be managed via UI, Admin Config Service (ACS API), or Splunk REST APIs.

Workarounds:
  • Edit and update lookup files using the Splunk app for Lookup File Editing.
  • Use the outputlookup command to update the lookup.
2021-08-12 SPL-210244 No default value selected on radio buttons in Simple XML dashboards
2021-08-05 SPL-209879 Unable to upload private apps in .tar.gz format on Victoria Experience.

Workaround:
Upload the app in .tar format
2021-05-24 SPL-206131 Examples Hub does not load when using a reverse proxy
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

Version 8.2.2106

This version includes the following known issues:

Date filed Issue number Description
2021-08-05 SPL-209879 Unable to upload private apps in .tar.gz format on Victoria Experience.

Workaround:
Upload the app in .tar format
2021-05-24 SPL-206131 Examples Hub does not load when using a reverse proxy
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following Issues:

Date filed Issue number Description
2021-06-29 SPL-207228 Invalid UTF-8 bytes (stats search corruption) in audit.log search results break search head cluster heartbeat communication
2021-05-13 SPL-205645 Index deletion fails in deployments on Victoria Experience
2021-05-11 SPL-205528 manager/search/datainputstats only displays a maximum of 30 modular inputs

Version 8.2.2105

This version includes the following known issues:

Date filed Issue number Description
2021-05-24 SPL-206131 Examples Hub does not load when using a reverse proxy
2021-05-13 SPL-205645 Index deletion fails in deployments on Victoria Experience
2021-05-11 SPL-205528 manager/search/datainputstats only displays a maximum of 30 modular inputs
2021-04-30 SPL-205069 onunloadCancelJobs failed to cancel search job on Safari

Workaround:
Use another browser such as Chrome or Firefox

This version fixes the following issues:

Date filed Issue number Description
2021-06-30 SPL-207554 Savedsearches.conf not in sync/not replicating to all SHC members

Version 8.2.2104

This version includes the following known issues:

Date filed Issue number Description
2021-05-24 SPL-206131 Examples Hub does not load when using a reverse proxy


Version 8.1.2103

This version includes the following known issues:

Date filed Issue number Description
2021-05-24 SPL-206131 Examples Hub does not load when using a reverse proxy

This version fixes the following issues:

Date filed Issue number Description
2021-04-21 SPL-201945 streamstats command not functioning as expected after upgrade

Version 8.1.2101

This version includes the following known issues:

Date filed Issue number Description
2021-04-21 SPL-201945 streamstats command not functioning as expected after upgrade
Last modified on 23 August, 2022
PREVIOUS
New features 		  NEXT
Splunk Cloud Platform Field alias behavior change

This documentation applies to the following versions of Splunk Cloud Platform™: 9.0.2208

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters