Splunk Enterprise

No entries match these filters. Clear filters

1. changelog Oct 29, 2026 · issue 124

   Splunk Enterprise 8.2 adds Federated Search, Dashboard Studio, durable scheduled reports, and four new JSON eval functions plus the tojson command⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Convert raw log events into JSON-structured data inline during a search for downstream processing or indexing.
   copy

   $ index=main sourcetype=syslog | tojson

   Append a new element to an existing JSON array field and extend a JSON object with array values in a single search pipeline.
   copy

   $ index=main | eval tags=json_append(tags, "new_tag") | eval metadata=json_extend(metadata, tag_array)

   • Adds new JSON-structured data capabilities for searches, including the tojson search command, plus four new JSON eval functions — json_array_to_mv, mv_to_json_array, json_append, and json_extend — to convert, append to, and extend JSON-structured data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Splunk Enterprise now uses HTTP compression by default in place of SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. compression, reducing the security vulnerability surface.
   • Run Federated Search across multiple Splunk Enterprise and Splunk Cloud Platform deployments from a single interface.
   • Build and customize dashboards with Dashboard Studio, a new dashboard experience with advanced visualization tools and fully customizable layouts.
   • Adds new health report capabilities: monitor ingestion latency to detect when forwarders have fallen behind, and identify excessive disk I/O wait times via the new IOWait feature, with status also written to health.log.

   +3 more show less

   • Health report now captures feature health status across nodes in distributed environments, including search head cluster members.
   • Workload Management now lets you enable or disable individual workload rules and admission rules, and displays a default message when it terminates a search due to an out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. (OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.) condition.
   • Ensure at-least-once delivery of events for scheduled reports with the new Durable Search feature, causing incomplete reports to be rerun automatically.
   • Adds new JSON-structured data capabilities for searches, including the tojson search command, plus four new JSON eval functions — json_array_to_mv, mv_to_json_array, json_append, and json_extend — to convert, append to, and extend JSON-structured data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Run Federated Search across multiple Splunk Enterprise and Splunk Cloud Platform deployments from a single interface.
   • Build and customize dashboards with Dashboard Studio, a new dashboard experience with advanced visualization tools and fully customizable layouts.
   • Adds new health report capabilities: monitor ingestion latency to detect when forwarders have fallen behind, and identify excessive disk I/O wait times via the new IOWait feature, with status also written to health.log.
   • Ensure at-least-once delivery of events for scheduled reports with the new Durable Search feature, causing incomplete reports to be rerun automatically.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !SSL compression is replaced with HTTP compression by default except when forwarding — deployments relying on SSL compression will need to review their configuration.
2. changelog Oct 14, 2026 · issue 108

   Splunk Cloud Platform gains OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth.-based Configuration Management REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for managing instance configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3. changelog Oct 1, 2026 · issue 091

   Splunk Enterprise 10.6 adds $8$ FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments.-compliant encryption, PostgreSQL-backed KV store, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. Federated Search, and Edge Processor aggregation/dedup⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Migrate all non-$8$ encrypted secrets on a standalone Splunk Enterprise instance to the new FIPS-compliant $8$ cipher format after upgrading to 10.6.
   copy

   $ splunk reencrypt secrets

   Migrate encrypted secrets across all members of a search head cluster to the $8$ cipher format in one step.
   copy

   $ splunk reencrypt shcluster-secrets

   Enable no-restart app uninstall on Splunk Enterprise 10.6 to reduce operational disruption when removing apps.
   $SPLUNK_HOME/etc/system/local/limits.conf copy

   [reload_on_delete]
   disabled = false

   • Adds splunk reencrypt secrets and splunk reencrypt shcluster-secrets CLI commands to migrate encrypted configuration values from the $7$ cipher format to the new FIPS-compliant $8$ cipher format (HKDF-SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [reload_on_delete] stanza with disabled = false / disabled = true toggle in limits.conf to enable no-restart app uninstall operations, reducing restart requirements by ~50%.
   • Replaces MongoDB-backed KV store with a PostgreSQL-backed co-hosted KV store on supported Linux, Windows, and macOS platforms, preserving existing KV store APIs and application workflows.
   • Adds mTLS (mutually-authenticated TLS) protocol support for Federated Search - Hybrid Model, requiring a client certificate installed on the Splunk Cloud Platform deployment.
   • Adds stateful aggregation of Edge Processor pipeline events via the stats SPL2 command within a configurable state window.

   +9 more show less

   • Adds deduplication of Edge Processor pipeline events via the dedup SPL2 command to remove events with identical field values.
   • Adds support for sending raw data from Edge Processors to Splunk indexes using the services/collector/raw HTTP Event Collector (HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.) endpoint.
   • Adds if SPL2 command support in Edge Processor pipelines for conditional if-else data handling.
   • Adds SPL2 conversion functions in Edge Processor pipelines: array_to_csv, csv_to_array, kv_keys, kv_to_object, object_to_csv, object_to_kv.
   • Adds configuration change tracking via audit logs in the _audit index for Splunk Enterprise, recording who changed what and when via Splunk Web or the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
   • Adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.-based automatic user de-provisioning for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. users, removing users from Splunk search heads when deleted from Entra ID or when Splunk access is revoked.
   • Adds support for running Splunk Enterprise on aarch64 (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) processor architecture, including AWS Graviton 4 VMs, in FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. mode (conditional availability).
   • Adds ability to delete disconnected Edge Processor instances from the Edge Processor details page.
   • Adds ability to choose the default telemetry indexer during Edge Processor first-time setup.
   • Adds splunk reencrypt secrets and splunk reencrypt shcluster-secrets CLI commands to migrate encrypted configuration values from the $7$ cipher format to the new FIPS-compliant $8$ cipher format (HKDF-SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds [reload_on_delete] stanza with disabled = false / disabled = true toggle in limits.conf to enable no-restart app uninstall operations, reducing restart requirements by ~50%.
   • Adds mTLS (mutually-authenticated TLS) protocol support for Federated Search - Hybrid Model, requiring a client certificate installed on the Splunk Cloud Platform deployment.
   • Adds stateful aggregation of Edge Processor pipeline events via the stats SPL2 command within a configurable state window.
   • Adds deduplication of Edge Processor pipeline events via the dedup SPL2 command to remove events with identical field values.

   +8 more show less

   • Adds support for sending raw data from Edge Processors to Splunk indexes using the services/collector/raw HTTP Event Collector (HECHECAn HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools.) endpoint.
   • Adds if SPL2 command support in Edge Processor pipelines for conditional if-else data handling.
   • Adds SPL2 conversion functions in Edge Processor pipelines: array_to_csv, csv_to_array, kv_keys, kv_to_object, object_to_csv, object_to_kv.
   • Adds configuration change tracking via audit logs in the _audit index for Splunk Enterprise, recording who changed what and when via Splunk Web or the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
   • Adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.-based automatic user de-provisioning for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. users, removing users from Splunk search heads when deleted from Entra ID or when Splunk access is revoked.
   • Adds support for running Splunk Enterprise on aarch64 (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) processor architecture, including AWS Graviton 4 VMs, in FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. mode (conditional availability).
   • Adds ability to delete disconnected Edge Processor instances from the Edge Processor details page.
   • Adds ability to choose the default telemetry indexer during Edge Processor first-time setup.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Federated searches will fail if any remote search head runs a version lower than Splunk Enterprise 10.4 after upgrading; all remote search heads must be upgraded to Splunk Enterprise 10.4 or higher before upgrading the deployment.
   • !TLS 1.0 and TLS 1.1 are no longer supported for inter-Splunk component connections and cannot be re-enabled; deployments must use TLS 1.2 or 1.3.