Release history for the Splunk Add-on for Linux¶
Latest release¶
The latest version of the Splunk Add-on for Linux is version 2.1.1. See Release notes for the Splunk Add-on for Linux for the release notes of this latest version.
Version 2.1.0¶
Version 2.1.0 of the Splunk Add-on for Linux was released on July 25, 2022.
Compatibility¶
Version 2.1.0 of the Splunk Add-on for Linux is compatible with the following software, CIM versions, and platforms:
| Component | Description |
|---|---|
| Splunk platform version | 8.1.x, 8.2.x, 9.0.x |
| CIM | 5.0.1 |
| Supported OS for data collection | Linux |
| Vendor products | Red Hat 7.8, Red Hat 8.5, Red Hat 8.6, CentOS 7, CentOS Stream 8.2015, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, SUSE 15 SP3, Debian 9, Debian 10.9, Debian 11. |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.
Upgrade¶
Follow the installation instructions to upgrade an existing installation of the Splunk Add-on for Linux. See Install the Splunk Add-on for Linux.
No data migration is required to upgrade the Splunk Add-on for Linux from version 2.0.0 to version 2.1.0.
New features¶
Version 2.1.0 of the Splunk Add-on for Linux has the following new features.
- Support for CIM v 5.0.1
- Support for Ubuntu v22.04 and Red Hat v8.6 OS
- Added the
linux_audit_endpoint_serviceseventtype for SERVICE_START and SERVICE_STOP audit logs. - Removed the extraction for
user=unsetfortype=USER_LOGINin the audit logs.
Fixed issues¶
Version 2.1.0 of the Splunk Add-on for Linux has the following, if any, fixed issues. If no issues appear in this section, no issues have yet been reported:
Known issues¶
Version 2.1.0 of the Splunk Add-on for Linux contains the following known issues. If no issues appear in this section, no issues have yet been reported:
Version 2.0.0¶
Version 2.0.0 of the Splunk Add-on for Linux was released on February 8, 2022.
Compatibility¶
Version 2.0.0 of the Splunk Add-on for Linux is compatible with the following software, CIM versions, and platforms:
| Component | Description |
|---|---|
| Splunk platform version | 8.1.x, 8.2.x |
| CIM | 4.20 |
| Supported OS for data collection | Linux |
| Vendor products | Red Hat 7.8, Red Hat 8.5, CentOS 7, CentOS Stream 8.2015, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, SUSE 15 SP3, Debian 9, Debian 10.9, Debian 11. |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, see the Splunk Enterprise Release Notes.
Upgrade¶
Follow the installation instructions to upgrade an existing installation of the Splunk Add-on for Linux. See Install the Splunk Add-on for Linux.
No data migration is required to upgrade the Splunk Add-on for Linux from version 1.1.1 to version 2.0.0.
New features¶
Version 2.0.0 of the Splunk Add-on for Linux has the following new features.
- New CIM Mapping
Fixed issues¶
Version 2.0.0 of the Splunk Add-on for Linux has the following, if any, fixed issues. If no issues appear in this section, no issues have yet been reported:
Known issues¶
Version 2.0.0 of the Splunk Add-on for Linux contains the following known issues. If no issues appear in this section, no issues have yet been reported:
Version 1.1.1¶
Version 1.1.1 of the Splunk Add-on for Linux was released on May 4, 2021.
Compatibility¶
Version 1.1.1 of the Splunk Add-on for Linux is compatible with the following software, CIM versions, and platforms:
| Component | Description |
|---|---|
| Splunk platform version | 7.3.x, 8.0.x, 8.1.x |
| CIM | 4.11 |
| Supported OS for data collection | Linux |
| Vendor products | Linux as supported by CollectD. See also Unix operating systems. |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.
Upgrade¶
Follow the installation instructions to upgrade an existing installation of the Splunk Add-on for Linux. See Install the Splunk Add-on for Linux.
No data migration is required to upgrade the Splunk Add-on for Linux from version 1.0.1 to version 1.1.1.
New features¶
Version 1.1.1 of the Splunk Add-on for Linux has the following new features:
- Removed messages for “restart required” on the SH/SHC during new installations or upgrades.
Fixed issues¶
Version 1.1.1 of the Splunk Add-on for Linux has the following, if any, fixed issues. If no issues appear in this section, no issues have yet been reported:
Known issues¶
Version 1.1.1 of the Splunk Add-on for Linux contains the following known issues. If no issues appear in this section, no issues have yet been reported:
Version 1.1.0¶
Version 1.1.0 of the Splunk Add-on for Linux was released on April 20, 2018.
Compatibility¶
Version 1.1.0 of the Splunk Add-on for Linux is compatible with the following software, CIM versions, and platforms:
| Component | Description |
|---|---|
| Splunk platform version | 7.0.x, 7.1.x, 7.2.x, 7.3.x, 8.0 |
| CIM | 4.11 |
| Supported OS for data collection | Linux |
| Vendor products | Linux as supported by CollectD. See also Unix operating systems. |
Note
The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.
For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.
Upgrade¶
Follow the installation instructions to upgrade an existing installation of the Splunk Add-on for Linux. See Install the Splunk Add-on for Linux.
No data migration is required to upgrade the Splunk Add-on for Linux from version 1.0.0 to version 1.1.0.
New features¶
Version 1.1.0 of the Splunk Add-on for Linux has the following new features.
- CollectD metrics data
- AuditD support
Fixed issues¶
Version 1.1.0 of the Splunk Add-on for Linux fixes the following issues:
Known issues¶
Version 1.1.0 of the Splunk Add-on for Linux contains the following known issues:
Version 1.0.0¶
Version 1.0.0 of the Splunk Add-on for Linux is compatible with the following software, CIM versions, and platforms.
| Component | Description |
|---|---|
| Splunk platform versions | 6.4 and 6.5 |
| ITSI | ITSI Model for OS 2.4.0 |
| Platforms | Linux |
| Vendor Products | RHEL/Centos 6.x, 7.2+, Ubuntu/ Debian 12.x, 16.04+, SUSE 12 |
New features¶
Version 1.0.0 of the Splunk Add-on for Linux provides ITSI normalization for Linux metric data gathered from CollectD.
Known issues¶
Version 1.0.0 of the Splunk Add-on for Linux contains the following known issues.
Workaround: To workaround ADDON-11995, ADDON-12258 and ADDON-12259, Splunk recommend you collect data in JSON format or follow the instructions on how to configure the write_graphite CollectD plugin in Configure Collectd to send data to Splunk.