https://cybertoolchain.io/tools/splunk-enterprise New releases and features in Splunk Enterprise, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 07:52:39 GMT https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/MeetSplunk https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/MeetSplunk Thu, 29 Oct 2026 07:52:39 GMT Splunk Enterprise 8.2 adds Federated Search, Dashboard Studio, durable scheduled reports, and four new JSON eval functions plus the `tojson` command⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new JSON-structured data capabilities for searches, including the `tojson` search command, plus four new JSON eval functions — `json_array_to_mv`, `mv_to_json_array`, `json_append`, and `json_extend` — to convert, append to, and extend JSON-structured data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Splunk Enterprise now uses HTTP compression by default in place of SSL compression, reducing the security vulnerability surface. • Run Federated Search across multiple Splunk Enterprise and Splunk Cloud Platform deployments from a single interface. • Build and customize dashboards with Dashboard Studio, a new dashboard experience with advanced visualization tools and fully customizable layouts. • Adds new health report capabilities: monitor ingestion latency to detect when forwarders have fallen behind, and identify excessive disk I/O wait times via the new IOWait feature, with status also written to `health.log`. • Health report now captures feature health status across nodes in distributed environments, including search head cluster members. • Workload Management now lets you enable or disable individual workload rules and admission rules, and displays a default message when it terminates a search due to an out-of-memory (OOM) condition. • Ensure at-least-once delivery of events for scheduled reports with the new Durable Search feature, causing incomplete reports to be rerun automatically. Breaking changes: • SSL compression is replaced with HTTP compression by default except when forwarding — deployments relying on SSL compression will need to review their configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-enterprise https://docs.splunk.com/?resourceId=Platform_Admin_intro_config_management_api https://docs.splunk.com/?resourceId=Platform_Admin_intro_config_management_api Wed, 14 Oct 2026 07:44:17 GMT Splunk Cloud Platform gains OpenAPI-based Configuration Management REST API endpoints for managing instance configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds OpenAPI-specification-based Configuration Management API REST endpoints to create and update Splunk Cloud Platform instance configurations, complementing the existing standard REST API methods.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-enterprise https://docs.splunk.com/?resourceId=Splunk_Installation_AboutupgradingREADTHISFIRST https://docs.splunk.com/?resourceId=Splunk_Installation_AboutupgradingREADTHISFIRST Thu, 01 Oct 2026 07:34:14 GMT Splunk Enterprise 10.6 adds $8$ FIPS-compliant encryption, PostgreSQL-backed KV store, mTLS Federated Search, and Edge Processor aggregation/dedup⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `splunk reencrypt secrets` and `splunk reencrypt shcluster-secrets` CLI commands to migrate encrypted configuration values from the `$7$` cipher format to the new FIPS-compliant `$8$` cipher format (HKDF-SHA256).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `[reload_on_delete]` stanza with `disabled = false` / `disabled = true` toggle in `limits.conf` to enable no-restart app uninstall operations, reducing restart requirements by ~50%. • Replaces MongoDB-backed KV store with a PostgreSQL-backed co-hosted KV store on supported Linux, Windows, and macOS platforms, preserving existing KV store APIs and application workflows. • Adds mTLS (mutually-authenticated TLS) protocol support for Federated Search - Hybrid Model, requiring a client certificate installed on the Splunk Cloud Platform deployment. • Adds stateful aggregation of Edge Processor pipeline events via the `stats` SPL2 command within a configurable state window. • Adds deduplication of Edge Processor pipeline events via the `dedup` SPL2 command to remove events with identical field values. • Adds support for sending raw data from Edge Processors to Splunk indexes using the `services/collector/raw` HTTP Event Collector (HEC) endpoint. • Adds `if` SPL2 command support in Edge Processor pipelines for conditional if-else data handling. • Adds SPL2 conversion functions in Edge Processor pipelines: `array_to_csv`, `csv_to_array`, `kv_keys`, `kv_to_object`, `object_to_csv`, `object_to_kv`. • Adds configuration change tracking via audit logs in the `_audit` index for Splunk Enterprise, recording who changed what and when via Splunk Web or the REST API. • Adds SCIM-based automatic user de-provisioning for Microsoft Entra ID SAML users, removing users from Splunk search heads when deleted from Entra ID or when Splunk access is revoked. • Adds support for running Splunk Enterprise on `aarch64` (ARM64) processor architecture, including AWS Graviton 4 VMs, in FIPS 140-3 mode (conditional availability). • Adds ability to delete disconnected Edge Processor instances from the Edge Processor details page. • Adds ability to choose the default telemetry indexer during Edge Processor first-time setup. Breaking changes: • Federated searches will fail if any remote search head runs a version lower than Splunk Enterprise 10.4 after upgrading; all remote search heads must be upgraded to Splunk Enterprise 10.4 or higher before upgrading the deployment. • TLS 1.0 and TLS 1.1 are no longer supported for inter-Splunk component connections and cannot be re-enabled; deployments must use TLS 1.2 or 1.3. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-enterprise