Release history for the Splunk Add-on for Google Cloud Platform¶

The latest version of the Splunk Add-on for Google Cloud Platform is version 4.7.1. See Release notes for the Splunk Add-on for Google Cloud Platform for the release notes of this latest version.

Version 4.7.0¶

Version 4.7.0 of the Splunk Add-on for Google Cloud Platform was released on September 30, 2024.

About this release¶

Version 4.7.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	9.1.x, 9.2.x, 9.3.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud Pub/Sub Lite Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.7.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Provided compatibility for IPv6.
Provided custom sourcetype support for Cloud Storage Bucket and Pub/Sub inputs.
Security Fixes.
Cloud Monitoring Input Enhancement:
- Added “Host” field extraction.
- Fixed data duplication issues.

Fixed issues¶

Version 4.7.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.7.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.7.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.6.0¶

Version 4.6.0 of the Splunk Add-on for Google Cloud Platform was released on June 26, 2024.

About this release¶

Version 4.6.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	9.0.x, 9.1.x, 9.2.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud Pub/Sub Lite Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.6.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Compatibility with Python 3.9.

Fixed issues¶

Version 4.6.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.6.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.6.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.5.0¶

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform is not backward compatible. Downgrading to version 4.4.0 will lead to complete data duplication because of significant data collection changes regarding the Cloud Storage Bucket Input. Additionally, users will need to reconfigure their Cloud Storage Bucket inputs.

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform was released on April 18, 2024.

About this release¶

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	9.0.x, 9.1.x, 9.2.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud Pub/Sub Lite Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Improved performance for the Cloud Monitoring and Cloud Storage bucket inputs.

Resolved a higher memory utilization issue with the Cloud Monitoring input.
Resolved the following issues with the Cloud Storage Bucket input:
- Fixed data collection issues for the bucket size of more than 50,000 files.
- Migrated inputs from google_cloud_storage_buckets.conf file to inputs.conf under the stanza google_cloud_bucket_metadata.
- Resolved parallel data collection issue for more than four inputs.
- Each Cloud Storage Bucket input will have its separate .log file for logging and the naming convention for that would be splunk_ta_google_cloud_platform_google_cloud_bucket_metadata_<input_name>.log

Fixed issues¶

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.5.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.4.0¶

Version 4.4.0 of the Splunk Add-on for Google Cloud Platform was released on Jan 23, 2024.

About this release¶

Version 4.4.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	9.0.x, 9.1.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud Pub/Sub Lite Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.4.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Provided support for GCP Workload Identity federation feature (which is currently supported on AWS-EC2 and Azure-VM Workload).
Migrated from file-based checkpointing to the KV Store checkpointing mechanism on the Bigquery Billing input.

Fixed issues¶

Version 4.4.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.4.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.4.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.3.0¶

Version 4.3.0 of the Splunk Add-on for Google Cloud Platform was released on November 1, 2023.

About this release¶

Version 4.3.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.2.x, 9.0.x, 9.1.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud Pub/Sub Lite Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.3.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Enhanced support for data ingestion from the Cloud Monitoring service.
- Added support for filtering monitored projects that are contained within scoping projects. For more information, see the Metrics scopes overview topic in the Google Cloud documentation.
- Migrated from file-based checkpointing to the KV Store checkpointing mechanism for the Cloud Monitoring input.

Fixed issues¶

Version 4.3.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.3.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.3.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.2.0¶

Version 4.2.0 of the Splunk Add-on for Google Cloud Platform was released on Jul 26, 2023.

About this release¶

Version 4.2.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.2.x, 9.0.x, 9.1.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud Pub/Sub Lite Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.2.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Added support for two new types of input data collection:
- Cloud Pub/Sub Lite
- Cloud Pub/Sub Based Bucket

Fixed issues¶

Version 4.2.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.2.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.2.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.1.1¶

Version 4.1.1 of the Splunk Add-on for Google Cloud Platform was released on January 16th 2023.

About this release¶

Version 4.1.1 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.2.x, 9.0.x
CIM	5.0.2
Platforms	Windows,Linux
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

Fixed issues¶

Version 4.1.1 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.1.1 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.1.1 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.1.0¶

Version 4.1.0 of the Splunk Add-on for Google Cloud Platform was released on January 16th 2023.

About this release¶

Version 4.1.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.1.x, 8.2.x, 9.0.x
CIM	5.0.2
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Resource Metadata (Compute Engine, Cloud Storage, Kubernetes, VPC Access)

New features¶

Version 4.1.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Added support for three new types of Resource Metadata input data collection:
- Cloud Storage data
- Kubernetes data
- VPC access data
Renamed Resource metadata input to Resource Metadata (Compute Engine).
Added support to collect Firewall related metadata in the existing Compute Engine input.
Enhanced UI experience.
Fixed proxy data collection issue.
Fixed compatibility issue of Billing input in Windows and MacOS.
Minor bug fixes.

Fixed issues¶

Version 4.1.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.1.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.1.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 4.0.0¶

Version 4.0.0 of the Splunk Add-on for Google Cloud Platform was released on September 22, 2022.

About this release¶

Version 4.0.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.0.x, 8.1.x, 8.2.x
CIM	4.20
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Compute Engine

New features¶

To better align with the Google Cloud Platform, and to provide a better understanding of the data coming from the cloud, the 4.0.0 release of the Splunk Add-on for Google Cloud Platform contains improvements to sourcetyping that affect the google:gcp:pubsub:audit:auth, google:gcp:pubsub:audit:change, and google:gcp:pubsub:message source types.

These improvements provide more granular sourcetyping on incoming data from your GCP deployment, enhancing your ability to investigate and simplifying the development of dashboards in Splunk that use GCP data. Upgrading to version 4.0.0 or higher will cause any inline searches, pivots, or reports that use these source types to not work for the GCP data that is being ingested after upgrading to version 4.0.0 of this add-on.

To ensure continuity of searches and reports on GCP data coming in after the upgrade to version 4.0.0 or later, review and perform the steps contained in the Upgrade the Splunk Add-on for Google Cloud Platform topic in this manual.

Version 4.0.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Added sourcetype support for the Data Manager Google Cloud Platform input.

Fixed issues¶

Version 4.0.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 4.0.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 4.0.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 3.2.0¶

Version 3.2.0 of the Splunk Add-on for Google Cloud Platform was released on April 5, 2022.

About this release¶

Version 3.2.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.0.x, 8.1.x, 8.2.x
CIM	4.20
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud BigQuery Billing Google Cloud Storage Compute Engine

New features¶

Version 3.2.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Added support for the Google Cloud BigQuery Billing input through the following sourcetypes:
- google:gcp:billing:standard_usage_cost
- google:gcp:billing:detailed_usage_cost
- google:gcp:billing:pricing

Previously billing data was ingested in the google:gcp:billing:report sourcetype.

Google has deprecated regular file export of your Cloud Billing data to CSV and JSON. To export your Cloud Billing data for analysis, use Cloud Billing export to BigQuery.

To ingest Cloud BigQuery Billing data, you must delete your existing billing inputs before you upgrade to versions 3.2.0 and later of this add-on. After upgrading, you can then recreate your billing inputs. See the Configure Cloud BigQuery Billing inputs for the Splunk Add-on for Google Cloud Service topic in this manual.

Fixed issues¶

Version 3.2.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 3.2.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 3.2.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Cloud Platform

Version 3.1.1¶

Version 3.1.1 of the Splunk Add-on for Google Cloud Platform was released on September 8, 2021.

About this release¶

Version 3.1.1 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	8.0.x, 8.1.x, 8.2.x
CIM	4.18
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud BigQuery Billing (Deprecated) Google Cloud Storage Compute Engine

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features¶

Version 3.1.1 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Added native support for Cloud Storage - Usage log format.

Previously this data was ingested in the generic google:gcp:buckets:*data sourcetype.
UI component upgrades for compatibility with future versions of the Splunk software (jQuery removal).
The billing API used to fetch billing data is now deprecated. Users won’t be able to ingest billing data using the billing input.
Self-Service restart fix. Rolling restarts have been eliminated.
The sourcetype: google:gcp:buckets:accesslogs, which has been configured to work with the Change data model in the Common Information Model (CIM).
Improved CIM support for storage access events.

See Choose your Splunk Enterprise upgrade path for the Python 3 migration to learn more about migrating your deployment to Python3.

Fixed issues¶

Version 3.1.1 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 3.1.1 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 3.1.1 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Version 3.0.2¶

Version 3.0.2 of the Splunk Add-on for Google Cloud Platform was released on July 22, 2020.

About this release¶

Version 3.0.2 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	7.0.x ,7.1.x, 7.2.x, 7.3.x, 8.0.x
CIM	4.16
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud Billing Google Cloud Storage Compute Engine

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features¶

Version 3.0.2 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Increased Assets and Identities CIM data model compatibility
Increased Network Traffic CIM data model compatibility

See Choose your Splunk Enterprise upgrade path for the Python 3 migration to learn more about migrating your deployment to Python3.

Fixed issues¶

Version 3.0.2 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 3.0.2 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 3.0.2 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Version 3.0.0¶

Version 3.0.0 of the Splunk Add-on for Google Cloud Platform was released on March 4, 2020.

About this release¶

Version 3.0.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	7.0.x ,7.1.x, 7.2.x, 7.3.x, 8.0.x
CIM	None
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud Billing Google Cloud Storage Compute Engine

New features¶

Version 3.0.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Support for GCP resource metadata collection. Collect resource metadata to track configurations across deployments and compare them, and administer large deployments in GCP securely.
- Users can assign sourcetype while configuring an input from the Inputs page.
- See the REST API reference page to see the Cloud Resource Metadata APIs.
Support for the GCP Google Cloud Storage input.
- Support to ingest data directly from GCS buckets and bucket metadata of the selected buckets.
- Support for the following file formats: XML, CSV, JSON, TEXT
Support for the following sourcetypes, introduced as part of the Cloud Storage Bucket input:
- google:gcp:buckets:metadata
- google:gcp:buckets:csvdata
- google:gcp:buckets:jsondata
- google:gcp:buckets:xmldata
- google:gcp:buckets:data

See Choose your Splunk Enterprise upgrade path for the Python 3 migration to learn more about migrating your deployment to Python3.

Fixed issues¶

Version 3.0.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 3.0.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 3.0.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Version 2.0.0¶

Version 2.0.0 of the Splunk Add-on for Google Cloud Platform was released on October 21, 2019.

About this release¶

Version 2.0.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	7.0.x ,7.1.x, 7.2.x, 7.3.x, 8.0.x
CIM	None
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud Billing

New features¶

Version 2.0.0 of the Splunk Add-on for Google Cloud Platform contains the following new features.

Support for Python 3

See Choose your Splunk Enterprise upgrade path for the Python 3 migration to learn more about migrating your deployment to Python3.

Fixed issues¶

Version 2.0.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 2.0.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 2.0.0 of the Splunk Add-on for Google Cloud Platform incorporates the following third-party software or libraries:

Version 1.2.0¶

Version 1.2.0 of the Splunk Add-on for Google Cloud Platform is compatible with the following software, CIM versions, and platforms:


Splunk platform versions	6.6 or later
CIM	None
Platforms	Platform Independent
Vendor Products	Google Cloud Pub/Sub Google Cloud CloudMonitor service Google Cloud Billing

New features¶

Version 1.2.0 of the Splunk Add-on for Google Cloud Platform contains the following new and changed features.

Optimized Cloud pub/sub inputs to ingest metadata of events
- The following is an example of the new event format.

{
    publish_time: 1510876651
    message: {
        id: 172600725985922
        data: "foo,bar"
        attributes: {
            key1: xxx,
            key2: xxx
        }
    }
}

Migration tool for upgrading versions
Renamed sourcetypes and sources
- Changed google:pubsub to google:gcp:pubsub:message
- Changed google:billing:csv to google:gcp:billing:report
- Changed google:billing:json to google:gcp:billing:report
- Changed google:cloudmonitor to google:gcp:monitoring
Source change of billing
- Change from {file_name} to URI https://storage.cloud.google.com/{bucket_name}/{file_name}
Source change of pubsub
- Change from {project_name}:{subscription_name} to projects/{project_name}/subscriptions/{subscription_name}
Proxy type http_no_tunnel is no longer supported

Fixed issues¶

Version 1.2.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 1.2.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 1.2.0 of the Splunk Add-on for Google Cloud Platform does not incorporate any third-party software or libraries.

Version 1.1.0¶

Version 1.1.0 of the Splunk Add-on for Google Cloud Platform has the same compatibility specifications as version 1.1.0.

Fixed issues¶

Version 1.1.0 of the Splunk Add-on for Google Cloud Platform fixes the following issues:

Known issues¶

Version 1.1.0 of the Splunk Add-on for Google Cloud Platform contains the following known issues:

Third-party software attributions¶

Version 1.1.0 of the Splunk Add-on for Google Cloud Platform does not incorporate any third-party software or libraries.