About upgrading to 10.6 READ THIS FIRST

Security change: Certificate authorities no longer issue TLS certificates with both "Server Auth" and "Client Auth" EKUs by March 2027

Applicable components: All

To enhance security and comply with industry changes, DigiCert and other certificate authorities (CAs) began removing support for the "Client Authentication" Extended Key Usage (EKU) extensions from public transport layer security (TLS) certificates. One such CA that regularly issues certificates for Splunk, DigiCert, will fully remove support by March 1, 2027, and web browser vendors plan to remove support for CAs that continue issuing public CA certificates with this functionality from web browser trust stores.

This is not specifically a breaking change for Splunk platform 10.6, but it affects you and your Splunk Enterprise deployment if you use certificates for inter-Splunk connections that contain both EKU extensions. You must contact the CA who issues your certificates and obtain updated versions that only contain the "Server Authentication" EKU extension before March 1, 2027. For additional information about EKUs, see Third-party Certificate Authorities cease issuing certificates with 'ServerAuth' and 'ClientAuth' EKU Extensions in the Release Notes.

Splunk has removed support for versions 1.0 and 1.1 of the Transport Layer Security (TLS) protocol

Applicable components: Splunk Enterprise

Splunk deprecated support for TLS protocol versions 1.0 and 1.1 for network connections between Splunk components in Splunk Enterprise 10.0 and completely removed support in version 10.4. Additionally, Splunk removed the option to temporarily turn on and use these deprecated protocol versions. Migrate to using TLS version 1.2 or higher for network connections between Splunk components.

Splunk changed the provider verification mode for Federated Search

Applicable components: Splunk Enterprise

Splunk changed the provider verification mode for Federated Search, which controls how federated search heads respond to remote search heads that run earlier versions of the Splunk platform.

If you use Federated Search for Splunk, upgrade all remote provider deployments to Splunk Enterprise version 10.4 or higher before starting an upgrade of your deployment. Federated searches fail if any remote search head or remote provider deployment runs a version lower than Splunk Enterprise version 10.4.

Splunk removed the binary files that were associated with older versions of the MongoDB database engine

Applicable components: Splunk Enterprise

Splunk removed the binaries for unsupported versions of the MongoDB database engine from the installation package in Splunk Enterprise 10.4.

Upgrade KV Store to MongoDB engine version 7 or higher before upgrading to Splunk Enterprise version 10.4.

Splunk changed how App Key Value Store (KV Store) uses TLS-related settings in the [kvstore] stanza of the server.conf configuration file

Applicable components: Splunk Enterprise

Splunk adjusted the logic that determines whether KV Store uses TLS-related settings in the [kvstore] stanza or falls back to similar settings in the [sslConfig] stanza of the server.conf configuration file.

Prior to Splunk platform 10.4, KV Store ignored TLS-related settings under the [kvstore] stanza that were also present in the [sslConfig] stanza. Beginning with Splunk platform 10.4, KV Store uses TLS-related settings that are present in the [kvstore] stanza first. This might cause unintended connection failures due to conflicting protocol configurations.

Review both stanzas in the server.conf file and remove any TLS-related settings under the [kvstore] stanza that you do not specifically use for securing KV Store connections.

Splunk Enterprise no longer lets you run it as the root user by default

Applicable components: Splunk Enterprise

$SPLUNK_HOME/bin/splunk start --run-as-root

Splunk Enterprise on Windows no longer lets you install, upgrade, or run it as an administrator-level user

Splunk removed support for Secure Hash Algorithm 1 (SHA1) certificate signatures

Applicable components: Splunk Enterprise

Splunk deprecated support for the usage of certificates with SHA-1 signatures in Splunk platform 10.0 and completely removed support in Splunk platform 10.4. Re-issue and migrate to certificates that use SHA-256 or higher signatures.

Splunk removed older unsupported MongoDB database engine binaries

Applicable components: Splunk Enterprise

Splunk removed the binaries for unsupported versions of MongoDB, the database engine that powers KV Store, from the installation package in Splunk Enterprise 10.4.

Upgrade KV Store to MongoDB engine version 7 or higher before upgrading to Splunk Enterprise version 10.4.

Splunk changed the capability requirements that you must satisfy to view dashboards that auto-refresh

Applicable components: Splunk Enterprise, Splunk Cloud Platform

Splunk changed the capability requirements for users who want to view dashboards that refresh automatically. With Splunk platform 10.4, non-administrator users must hold a role that contains the auto_refresh_dashboards capability.

If you have access to the admin or sc_admin accounts on the instance, add the auto_refresh_dashboards capability to a role that you can then grant to users who need to view auto-refreshing dashboards.

Splunk removed jQuery version 2 from the Splunk platform

Applicable components: Splunk Enterprise, Splunk Cloud Platform

Splunk has fully removed jQuery version 2 (jQuery 2) from the Splunk platform. This means that Splunk deleted the jQuery upgrade admin page, all jQuery libraries with a version of lower than 3, the quarantine framework, and all associated feature flags, including enable_jQuery2 and enable_unsupported_hotlinked_imports. All platform JavaScript now runs on jQuery version 3 and higher. Apps that hotlink jQuery 2 or rely on jQuery 2-specific APIs will no longer function.

Updated Linux distribution support on Splunk Enterprise affects Edge Processor on Splunk Enterprise support

Applicable components: Splunk Enterprise, Edge Processor on Splunk Enterprise

The Splunk platform uses version 3.13 of the Python runtime environment on Splunk Web

Applicable components: Splunk Enterprise

The Node.js JavaScript runtime environment has been removed

Applicable components: Splunk Enterprise

Splunk has removed the Node.js runtime environment, which it deprecated in version 10, from Splunk Enterprise as of version 10.2. This means that apps that require Node.js will no longer run. If you use or make an app that runs Node.js, then the app must include its own build of the Node.js runtime on Splunk 10.2 and higher.

The Splunk Fishbucket database back end has been replaced

Applicable components: Splunk Enterprise

Version introduced: 10.2

In Splunk Enterprise 10.2, a database back end for the Fishbucket, a repository used to store file-monitoring checkpoints, was replaced with a more reliable back end.

If you are upgrading from earlier Splunk Enterprise versions, you do not need to take any action. No explicit or implicit migration is required. After the upgrade, Splunk Enterprise will continue to read existing file checkpoints from the legacy Fishbucket database. Going forward, it will write new checkpoints to and read new checkpoints from the new repository.

This information is provided because downgrading from Splunk Enterprise 10.2 to an earlier version is not officially supported. Customers who choose to downgrade may lose checkpoints that were created after the upgrade. As a result, file-monitoring state might revert to the checkpoint position that existed prior to the upgrade, which can lead to partial re-ingestion of files and potential event duplication.

KV Store requires computers that have CPUs with AVX, SSE4.2, and AES-NI

Applicable components: Splunk Enterprise

Beginning with version 9.4 of Splunk Enterprise, any computer that runs the software must have a CPU that has support for the following extensions to the x86 instruction set architecture:

• Advanced Vector Extensions (AVX)
• Streaming SIMD Extensions 4.2 (SSE4.2)
• Advanced Encryption Standard: New Instructions (AES-NI).

Typically, these extensions have support on Intel CPUs that belong to the Sandy Bridge and later microarchitecture families. There is additional support for the AMD Bulldozer 15h GEN3 family of processor chips. In both cases, there is support only for the x86-64 instruction sets.

Computers that do not use CPU processors that support AVX, SSE4.2, and AES-NI are unable to run Splunk Enterprise, and an attempt to upgrade the software on such computers will fail. This is because the latest version of the database engine that KV Store uses does not have support for CPUs that do not have support for AVX, SSE4.2, and AES-NI.

You must upgrade or replace computers that do not meet the standard before you attempt an upgrade. See Upgrade the KV store server version in the Admin Manual to learn about these new requirements for KV Store and plan the upgrade.

READ THIS FIRST: Should you deploy field filters in your organization?

Applicable components: Splunk Enterprise

Field filters are a powerful tool that can help many organizations protect their sensitive fields from prying eyes, but field filters might not be a good fit for every deployment.

If your organization uses downstream configurations, such as accelerated data models, Splunk Enterprise Security (ES) detections using those data models, or user-level search-time field extractions, ensure you sufficiently plan for your field filter use cases on those configurations before deploying field filters in your environment. See READ THIS: Downstream impact of field filters.

If your organization runs Splunk Enterprise Security or if your users rely heavily on commands that field filters restricts by default (mpreview and mstats), do not use field filters in production until you have thoroughly planned how you will work around these restricted commands. See READ THIS: Restricted commands do not work in searches on indexes that have field filters.

Splunk Enterprise 9.1 fixes a critical vulnerability in deployment server but might introduce problems for older deployment clients

Applicable components: Splunk Enterprise

Splunk introduced a fix for a vulnerability in deployment server in version 9.0 of Splunk Enterprise, and this fix is also available in version 9.1. If you run a deployment server, upgrade that server to version 9.1 of Splunk Enterprise as soon as possible. Before the upgrade, carefully review your deployment server setup and the current versions of the deployment clients in your Splunk Enterprise network. Depending on the setup of your deployment server and whether that component shares a computer with other Splunk Enterprise components, you might need to do the following to ensure your deployment server and clients communicate without problems:

• Isolate deployment server from other components on a machine. Isolating your deployment server means you only have to upgrade that component. The sole exception for isolation is if you run a deployment server and a license manager on the same machine.
• Confirm that all deployment clients in your network run version 7.0.0 or higher of Splunk Enterprise or the universal forwarder. You don't have to upgrade deployment clients to version 9.0.0, but they must be at version 7.0.0 or higher to communicate with version 9.0.0 deployment servers.

See the following topics for additional information:

• SVD-2022-0608 for more about the vulnerability
• Client version compatibility in the Updating Splunk Enterprise Instances Manual for more about which versions of deployment client that the version 9.0.0 deployment server supports

Follow specific instructions to upgrade clusters

Applicable components: Splunk Enterprise

To upgrade indexer or search head clusters, follow the upgrade procedure for the type of deployment you have.

• If your deployment has indexer clusters, follow the index cluster upgrade instructions.
• If your deployment has search head clusters, follow the search head cluster upgrade instructions.

Back up App Key Value Store prior to starting an upgrade

Applicable components: Splunk Enterprise

Back up the app key value store (KV store) before any maintenance like an upgrade.

Confirm that you have accounted for this downtime in your upgrade planning. See Back up and restore KV store for more information.

Splunk has removed Analytics Workspace

Applicable components: Splunk Enterprise and Universal Forwarder

Macros now replicate by default to search peers

Applicable components: Splunk Enterprise

Macros used in apps are now replicated by default to search peers as part of the knowledge bundle in Splunk deployments. As a result of this change, searches that previously failed now run successfully, which could affect downstream performance.

If you don't want to replicate macros for your apps, you can suppress replication by setting replicate.macros = false in the [replicationSettings:refineConf] stanza in the distsearch.conf file. Be aware that disabling distribution of macros might negatively impact your search results.