What's new

You can now create custom pipeline templates and make them available to Edge Processor and Ingest Processor users through an SPL2-based app.

This feature includes updates to the following SPL2 REST API endpoints:

• services/orchestrator/v1/spl2/modules

• services/orchestrator/v1/spl2/modules/{resourceName}

See the following documentation:

• Create custom pipeline templates for information on creating a template and including it in an SPL2 app.

• Search endpoint descriptions in the Splunk Cloud Platform REST API Reference for information about the updated endpoints.

• Use templates to create pipelines for Edge Processors in the Use Edge Processors manual and Use templates to create pipelines for Ingest Processor in the Use Ingest Processors manual for information on creating a pipeline by using a template as a starting point.

Index-Based Search Targeting is a new enhancement for Federated Search in transparent mode. This feature allows administrators to route search requests directly to specific providers based on index-to-host mappings, providing you with greater control over your search environment. Index-based search targeting provides the following key benefits:

• Enhanced Security: By restricting searches to specific hosts, you minimize the exposure of sensitive information and ensure that query logs are only accessible where necessary.

• Optimized Performance: Reduce system overhead and improve search speeds by eliminating unnecessary requests, which allows your infrastructure to focus resources only on relevant search providers.

This update ensures a more secure, streamlined, and efficient search experience across Federated Search for Splunk environments.

Administrators can now use the following new REST endpoint arguments to configure index-based provider selection for Federated Search for Splunk by specifying which indexes federated search heads can access from federated providers when operating in transparent mode:

• The data/federated/settings/general endpoint: The allowIndexBasedProviderFiltering argument enables index-based filtering for federated providers.

• The data/federated/provider/{federated_provider_name} endpoint: The fedSrchIndexesAllowed argument specifies the indexes that are accessible from each federated provider.

See Federated search endpoint descriptions in the REST API Reference.

Config Tracker

Config Tracker provides centralized visibility into configuration changes made within Splunk cloud. It automatically records what changed, when, and who changed it, for supported configuration interfaces– Splunk Web UI, CLI and REST endpoint. This feature enables auditability, improves operational confidence, and accelerates troubleshooting by giving administrators a reliable change history.​

For more information, see Tracking configuration changes with audit logs.

Splunk Configuration Validation

Config Validation introduces a new platform capability that automatically verifies Splunk configuration changes before they impact production. It checks every .conf update against Splunk-defined schemas, version compatibility rules, and deployment constraints, detecting invalid, unsupported, or risky settings early. This dramatically reduces upgrade failures, outages, and troubleshooting time while enabling more automated, compliant, and predictable operations across Cloud and Enterprise environments.

For more information, see Validating configurations using the btool REST API.

OpenSSL upgrade

To enhance system security and ensure long-term stability, the OpenSSL library has been upgraded from version 3.0.18 to 3.5.5, the latest Long Term Support (LTS) version. This update provides the latest security patches and improved performance.

• View Splunk Observability Cloud Related Content in the Search app

• Override the default organization (User)