The updated FIPS 140-2 module that comes with Splunk Enterprise 10.0 is valid until March of 2026. This gives you time to move over to the new FIPS 140-3 module after you upgrade both Splunk Enterprise components and your forwarding tier infrastructure to version 10.

For more information about Splunk Enterprise and FIPS, see Secure Splunk Enterprise with FIPS. For information about upgrading FIPS in Splunk Enterprise, see Best practice for maintaining compliance with FIPS and Common Criteria in your Splunk Enterprise environment.

For more information on configuring fine-grained access for search knowledge objects, see Configure roles for fine-grained management of saved search objects, owners, and properties.

Sidecars are processes that run alongside the splunkd process to fulfill specific functions. They support introducing new features to the Splunk platform. For example, several sidecars support enhanced data management in the on-premises environment.

Sidecars affect your Splunk Enterprise environment by introducing multiple sidecar processes. Process names of sidecars don't include a splunk prefix.

To learn more about sidecars, see About Splunk sidecars.

To navigate to this page, in the Splunk bar, select Settings > Server settings > Dashboards Trusted Domains List.

To learn more, see Configure Dashboards Trusted Domains List.

If you notice any issues to troubleshoot or activities to investigate, you can get more details by searching the audit log.

It is a good practice to begin an audit of Splunk platform activity by reviewing the Audit Trail dashboards.

To learn more about the Audit Trail dashboards, see Auditing activities in a Splunk platform instance.

See the following topics for more information:

• Run federated searches over remote Splunk platform deployments in Federated Search.
• The savedsearch reference topic in Search Reference.

• mcollect
• sendalert
• sendemail

These commands can now run locally on the federated search head. See SPL commands that run on the federated search head in standard mode.

If you don't want to use Splunk Web to manage email domains, you can configure the allowedDomainList setting in the [email] stanza in the alert_actions.conf file instead.

Splunk Enterprise now supports OAuth 2.0 for SMTP server authentication. This release adds support for Microsoft Exchange Server. For Gmail SMTP server, you can use a Google app password instead of an account password with simple authentication (username/password).

See Configure email notification for Splunk Enterprise

READ THIS FIRST: Should you deploy field filters in your organization? Field filters are a powerful tool that can help many organizations protect their sensitive fields from prying eyes, but they might not be a good fit for everyone. If your organization runs Splunk Enterprise Security or if your users rely heavily on commands that field filters restricts by default (mpreview, mstats, and tstats), do not use field filters in production until you have thoroughly planned how you will work around these restricted commands. See READ THIS: Restricted commands do not work in searches on any indexes if field filters are in use in the Securing Splunk platform manual.

If your organization uses the Splunk Common Information Model (CIM), and field filters on the Splunk platform to protect sensitive fields, you should also understand the downstream impact of field filters on data model acceleration (DMA). For more information about the impact of field filters on DMA, see Plan for field filters in your organization in the Securing Splunk Platform in the Securing Splunk platform manual.

Splunk Enterprise 10.0 introduces the dynamic_max_searches_perc setting. This setting allows the search scheduler to automatically adjust the scheduled search concurrency limit (max_searches_perc) based on the ad hoc and scheduled search workload. This feature can reduce search latency, minimize skipped searches, and help you use search capacity more efficiently between ad hoc and scheduled searches.

See Dynamically manage scheduled search concurrency limits.

With this feature, you can see the real, active settings applied on forwarders, including all parameter changes in .conf files. It gives you a complete picture of the configuration currently in use. You can download the effective configuration files and open them in a text editor for further analysis.

You'll see a list of registered OTel Collectors in a table view. You can view more details along with key attributes by selecting an individual agent. This view-only functionality supports better visibility into how your data collection components are operating.

See Splunk Observability Cloud metrics in Splunk Cloud Platform.

See Preview observability data in the Related Content panel.

See Add a Splunk Observability Cloud service map to Dashboard Studio dashboards.

See Modify permissions for modules in the Splunk Enterprise Admin Manual.

If your organization has business-critical apps that still need to use the deactivated endpoints, you can turn them on for a limited time as a temporary fix. See Semantic API versioning in the REST API Reference Manual.

The alerts page is updated for usability and accessibility.