Splunk Enterprise 8.2

Main additional functions

Enhanced dashboard creation capabilities

  • Dashboard Studio has been added from Splunk Enterprise 8.2.
    1. In Splunk Enterprise 8.2, when creating a dashboard, in addition to the existing creation method (classic), you can select creation with Dashboard Studio.
      ・Customization such as inserting diagrams and arranging at absolute position has been improved, making it possible to achieve more advanced visualization.

Expanded health report functionality

  • Enhanced health reporting eliminates the need for administrators of distributed Splunk environments to log into multiple nodes.
    1. Added health status for each node in Search Head Cluster environment
    2. Added I/O Wait
    3. Added delay status for monitor capture

Addition of internal log output setting function when changing configuration file

  • Configuration file changes can now be audited at the filesystem level.
    1. By enabling the output of the internal log, changes will be noted in the "configuration_change.log" when the configuration file is changed.

Durable Search function

  • It is now possible to set the search to be re-executed when search results cannot be obtained normally due to an error, etc., when executing a search for a schedule report.
    1. It is possible to set each schedule report individually.

Some performance improvements

  • The efficiency of searchable rolling restart in multi-site cluster environments has been improved, significantly reducing the time required.
  • It can now be up to 10x faster if you have many scheduled searches running every minute and frequently update savedsearch.conf.
    1. This feature is off by default and is enabled by setting 'async_saved_search_fetch' in limits.conf.

End of support for Internet Explorer

  • Support for Internet Explorer has ended in Splunk Enterprise 8.2.
    1. Please use Firefox, Safari, or Chrome as your browser.

Click here for function information of past and other versions