What's new

Federated provider names are now fully case-insensitive — check your provider names before upgrading

Starting in 10.7.x, the Splunk platform consistently treats federated provider names as case-insensitive across Splunk Web, REST endpoints, and configuration files. If your deployment has provider names that differ only by case (for example, “MyProvider” and “myprovider”), the Splunk platform recognizes only one name after upgrade. Review your federated.conf entries and rename any case-only duplicates before upgrading.

Self-Service for "acceleration.allow_old_summaries = true" via WebUI or REST for DMAs

You can now configure the 'Allow Old Summaries' setting for Data Model Accelerations directly from Splunk Web, without contacting Splunk support. Splunk Enterprise users can still configure ‘allow_old_summaries' in the limits.conf file.

This setting controls whether your DMA searches include results from summaries built before a data model definition change. When the setting is turned on, searches draw from both old and new summaries so you can continue searching historical data while new summaries are being rebuilt. When this setting is set to the default, which is off, searches reflect only your current data model definition.

For more information, see “When the data model definition changes and your summaries have not been updated to match it” in the Knowledge Management manual.

Edit a streaming Machine Data Lake promotion

You can update supported processing configuration for a running Machine Data Lake streaming promotion to a Splunk index while preserving the job's identity, ownership, audit history, and safe lifecycle.

For more information, see Monitor and manage promotion jobs.

Machine Data Lake support across multiple search heads

Machine Data Lake preserves the selected search-head context and authorization boundaries across discovery, search, preview, promotion, job management, and dataset lifecycle workflows on supported multi-search-head Splunk Cloud stacks.

Continuous promotion to Machine Data Lake Analytics Tables

You can continuously promote selected Machine Data Lake data into an analytics table for recurring analysis, summary workloads, scheduled alerting, and long-term queryable retention.

For more information, see Promote data to an analytics table.

Python runtime changes

In Splunk Cloud Platform v. 10.7, Python 3.9 is turned off by default. Python 3.13 remains the default interpreter, and Python 3.14 is available as an opt-in interpreter. Apps and technology add-ons that depend on Python 3.9 may require updates to work with Python 3.13 or 3.14.

Before and after upgrading, in the Cloud Monitoring Console (CMC), under Health, use Apps not configured as compatible with Python version 3.13 to check if there are apps on your stack that aren't configured for Python 3.13. These apps continue to run before the upgrade.

After the upgrade, apps that aren't compatible with Python 3.13 will be forced to run on Python 3.13, and Splunk can't guarantee that they will work as expected. Use the built-in Splunk Health Report to identify apps running in this mode.

If an app that is critical to your operations isn't yet compatible with Python 3.13, contact Splunk Support to request that Python 3.9 be made temporarily available on the affected stack.

For more information, see Python compatibility.

Workload Management Controls for Federated Search

Splunk administrators can identify Federated Search workloads executing on remote search heads and apply Workload Management admission rules based on whether the remote work originated from a scheduled or ad hoc search.

These controls help customers protect remote search capacity and critical local workloads by allowing selected federated workloads to be governed without changing existing search syntax or introducing a separate administration workflow. Available with Splunk 10.8 for supported Standard and Transparent mode Federated Search for Splunk configurations.

For more information, see Create an admission rule using Splunk Web.

Manage datasets and connections in Catalog

Catalog is now the single place to discover and manage your federated and MDL raw datasets and their connections, which previously lived in Data Management. Create, edit, and delete datasets and connections, view all existing connections in the new Connections tab, and promote MDL datasets and track promotion jobs, with existing access controls and governance preserved.

Custom SMTP server for alert and report emails

Splunk Cloud Platform now supports custom SMTP servers for alert and report emails, so administrators can send notifications from a company-owned domain. Configure username and password or OAuth 2.0 authentication with SSL or TLS in Settings > Server settings > Email settings. Custom SMTP is available for standard search head instances; SOAR instances continue to use the default mail service. If custom SMTP delivery fails, Splunk Cloud Platform does not automatically switch to the default service.

For configuration details, see Email notification action.

Application-layer authentication between forwarders and indexers

Splunk Cloud Platform introduces application-layer authentication to strengthen Splunk-to-Splunk (S2S) communication. During connection establishment, forwarders and indexers perform a mutual authentication exchange in addition to the transport security provided by Transport Layer Security (TLS). Each connection performs an independent exchange in which both sides verify authentication proofs. The exchange operates in audit mode by default, without additional configuration. Splunk software records authentication outcomes and provides monitoring metrics without interrupting data forwarding if authentication fails.

For more information see Application-layer authentication between forwarders and indexers.