Ingest Actions Enhancements

• Added the ability to route data to NFS and local storage using Ingest Actions.

Bookmarking the Splunk Web Homepage

• ●Bookmark functionality has been added to the SplunkWeb homepage.
  You can create bookmarks for users or for sharing with your organization.

Dashboard Studio enhancements

• ● You can now schedulea series of tasks to export dashboards as PDF and PNG and distribute them by email.

Automated rolling upgrades for indexer clusters

• A rolling upgrade is an upgrade method that minimizes the impact to ongoing searches and data ingestion.
• The splunk-rolling-upgrade app in a default installation automates steps that were previously performed manually.
  • 1. Distribute settings from the cluster manager to the cluster peers
    1. On the cluster manager, create the following file:
       ・File path
       $SPLUNK_HOME/etc/apps/splunk-rolling-upgrade-config/default/rolling_upgrade.conf
       
       File contents
       [downloader]
       package_path = <path to installer package>
       md5_checksum = <md5 checksum of installer package>
    2. $SPLUNK_HOME/etc/apps/splunk-rolling-upgrade-config
       Copy it to the $SPLUNK_HOME/etc/manager-apps directory.
    3. Distribute the configuration to the cluster peers.
  • 2. Automatic Rolling Upgrades

    Use the REST API or CLI commands to perform the upgrade of the cluster manager and peers.

    1. Run the command on the cluster manager to start the upgrade.
       curl -X POST -u admin:pass -k "https://<host>:<mPort>/services/upgrade/cluster/manager?output_mode=json"
    2. Monitor the cluster manager upgrade to ensure it is complete.
       curl -X GET -u admin:pass -k "https://<host>:<mPort>/services/upgrade/cluster/status?output_mode=json"
    3. Run the command on the cluster manager to initiate the upgrade of the cluster peers.
       curl -X POST -u admin:pass -k “https://<host>:<mPort>/services/upgrade/cluster/all_peers?output_mode=json“
    4. Watch the cluster peer upgrade progress begin and complete.
       curl -X GET -u admin:pass -k "https://<host>:<mPort>/services/upgrade/cluster/status?output_mode=json"

    *$SPLUNK_HOME is the default installation directory.
    *Only supported on Linux/Unix OS.
    *To use the splunk-rolling-upgrade app, you must have the “splunk_system_upgrader” role.
    *Only applies to upgrades from version 9.3 onwards to later versions.

Upgrading Python version to 3.9

• ●The version of Python shipped with Splunk has been upgraded to 3.9.
• Use the Upgrade Readiness App 4.5.0 to check if your apps are compatible with Python 3.9.

*Currently, there is an option to revert to Python 3.7, but this is not recommended as it will be deprecated in the future.

Click here for function information of past and other versions