• If you have quarantined CSV lookups within your search head cluster, information about those lookups now appears in the dashboard's "Attention required" section.

Alerts dashboard updates:

• Added a pre-configured "Quarantined CSV lookups within SHC" alert, which notifies you about quarantined CSV lookups, so you can take action to reduce the lookup size.

Health dashboard updates:

• Added a new health indicator for missing ciphers that checks for events indicating no ciphers compatible with the TLS version are present in your configuration.
• The health indicator table now includes a "Tags" column to further categorize and quickly identify deeper levels of relevant information about each health indicator.

Federated Search for Amazon S3 dashboard updates:

• Added a new chart for Top 10 Data Scan Unit (DSU) users.

Other updates:

• Summary events collected by the following saved searches have been moved from index=summary to index=_cmc_summary. This change improves dashboard load times for large deployments. If your custom dashboards or reports rely on events from index=summary, you may experience disruptions. The following data has moved to index=_cmc_summary:
  • splunk-search-seconds
  • splunk-svc
  • splunk-svc-consumer
  • splunk-ingestion
  • splunk-search-count
  • splunk-storage-detail
  • splunk-storage-summary
  • splunk-entitlements
  • splunk-ddaa-detail
  • splunk-ddaa-summary
  • splunk-fss3-usage
  • splunk-federated-analytics-usage
  • splunk-federated-analytics-ingest-usage-by-svc

• Fixed an issue with incorrect timezone setting.
• Fixed an issue with border styling in Workload dashboard
• Fixed an issue with relative timestamping in DSU usage chart.

index=summary

Workaround: Update your SPL searches in any custom dashboards or reports to query data from both index=summary and index=_cmc_summary. For more information, see this support article.

• Health and Overview dashboards now read from a new _cmc_summary index that improves dashboard load times for large deployments.

Workload dashboard updates:

• The dashboard layout has been redesigned to improve UI responsiveness.
• Percentage values of less than 1 percent, but greater than 0, now render as "< 1%".

Federated Search for Amazon S3 dashboard updates:

• The Federated Search for Amazon S3 dashboard now includes a Top 10 section with time picker, that shows Top 10 apps, users, and searches.

• Fixed an issue where only scheduled status maintenance windows show in the top cards in Maintenance and Overview dashboards.

• Fixed an issue where deployments with Cross-Region Disaster Recovery entitlement show incorrect health items requiring attention in the Overview dashboard. The health dashboard itself continues to show correct information.
• Fixed an issue where if the KVstore is down or a user does not have all sc_admin privileges, that user cannot add new metrics to the Overview dashboard. The existing Overview dashboard will still show all available metrics.

• The Overview dashboard is now officially GA and is no longer in preview mode.
• Added new "Find in CMC" search tool that lets you find CMC metrics and dashboards.
• The CMC now tracks maintenance windows, change freezes, blocked indexer queues, HEC 503 errors, and missing forwarders in the background and will show these when they require your attention.
• Added new "View or Manage items" button that lets you view and manage metrics that CMC monitors in the background.

Workload dashboard updates:

• Added new search head CPU and memory utilization cards.

Federated Search for Amazon S3 dashboard updates:

• Modernized Federated Search for Amazon S3 dashboards are now visible in the CMC.

• Fixed an issue that limited health drill down table results to 10k rows.
• Fixed an issue with the search head dropdown on search tab on the Workload dashboard not responding correctly to window size changes.
• Fixed an issue with incorrect spacing on Federated Analytics DSU usage over time dashboard.
• Added missing tokens for Workload dashboard queries.

• Deployments with Cross-Region Disaster Recovery entitlement show incorrect health items requiring attention in the Overview dashboard. The health dashboard itself continues to show correct information.
• If the KVstore is down or a user does not have all sc_admin privileges (as required by the CMC), that user cannot add new metrics to the Overview dashboard. The existing Overview dashboard will still show all available metrics.

• The Overview (preview) dashboard is now the default landing page for the CMC app.
• Added a section that shows metrics from the Health dashboard that require attention.

Federated Analytics dashboard updates:

• Created a Federated Analytics SVC usage panel to show SVC usage related to your Federated Analytics entitlement if applicable.
• Made minor UI improvements

Federated Search for Amazon S3 dashboard updates:

• Added a Current license entitlement panel that shows your entitlement data for Federated Search for Amazon S3 if applicable.

Other update:

• Redesigned the Data Quality dashboard to improve the UI appearance.

• Fixed an issue that caused the Potentially inefficient searches panel in the Expensive searches dashboard to duplicate the search query in each entry.

• Deployments with Cross-Region Disaster Recovery entitlement show incorrect health items requiring attention in the Overview dashboard. The health dashboard itself continues to show correct information.

• You can select a different time range for your Top metrics.
• Find Optimization resources at the bottom of the dashboard for more information on how to optimize resources.
• The dashboard displays a notice that mentions the eventual transition to the new default Overview dashboard.

Workload (preview) dashboard updates:

• Provide feedback about the dashboard to share concerns and a rating for the new Workload dashboard experience.

Other updates:

• Added Splunk Forwarder version 9.4 and the corresponding support date to the CMC.
• Made minor UI text and visual updates to the Overview (preview) and Workload (preview) dashboards.

If you're concerned about the URL change or that the transition will impact any processes, operations, monitoring or troubleshooting workflows, let us know in the CMC Workload dashboard (preview) feedback tool.

• Fixed a calculation in the Data quality dashboard SPL.
• Fixed an issue that caused the Forwarder versions dashboard to show incorrect values.
• Fixed an issue that caused the Top metrics section to reload when selecting Personalize in the Overview (preview) dashboard.
• Fixed an issue that caused the Workload (preview) dashboard to display Search and Indexing Peak SVC usage by tier instead of process.

• The Health dashboard displays a false critical state after upgrading forwarders to the latest version.

• Redesigned the Storage Searchable storage (DDAS) dashboard.
• Updated the Health dashboard to provide expiration dates for both the universal forwarder and heavy forwarder software versions.
• Adjusted text alignment in the Overview (preview) dashboard.
• Updated the Federated Analytics (preview) and the Federated Search for Amazon S3 dashboards to calculate usage more accurately when contracts change.
• Removed the scrollbar in the Index details section of the Storage summary and Searchable storage (DDAS) dashboards.

Workload dashboard updates:

• Adjusted SVC attribution searches to split by tier instead of host to prevent a large amount of results.
• Added a modal for users to discover the Workload (preview) dashboard and inform them that the redesigned dashboard will be the default dashboard soon.

• Fixed an issue that caused the SVC usage panels in the Federated Analytics (preview) dashboard to not display outlier values in the sparkline.
• Fixed spacing typo in dashboard Workload (preview) description.
• Fixed an issue that caused the Health dashboard to filter forwarders incorrectly.

• The Forwarder versions dashboard shows an incorrect forwarder count value.
  • Workaround: Open the Version summary panel in search or view the Health dashboard to view the correct forwarder count value.
• The Health dashboard displays a false critical state after upgrading forwarders to the latest version.

• Added an Indexer CPU utilization panel
• Added open-in-search and refresh actions in the Overall, Search, and Indexing tabs

Federated Analytics dashboard updates:

• Added info icons to the top row of panels
• Added a Daily ingest volume panel

Maintenance dashboard update:

• Improved the change freeze functionality for Splunk Cloud Platform on Microsoft Azure

• Fixed a text spacing issue in the Personalize top metrics modal in the Overview (preview) dashboard.
• Fixed an issue that affected the mock data when you make modifications to your metric selection in the Overview (preview) dashboard.
• Fixed an issue that caused the Storage summary dashboard panels to not display data.
• Fixed an issue that caused false warning messages about wildcard usage in SPL on some CMC panels on Splunk Cloud Platform version 9.2.2403.108.

• Fixed an issue that caused the panel for the Top 20 Most Memory Consuming Searches on the expensive searches dashboard to display the wrong Search Duration.
• Fixed an issue that caused some admins to not be shown the What's New modal in environments with more than 100 users.
• Reverted a change in version 3.30.0 that prevented CMC pages from loading successfully. This affected SAML users who did not have the sc_admin role.

• Updated the See documentation button in the Overview (preview) dashboard to open in a new tab.
• Adjusted the single value position in the Overview (preview) dashboard metric cards.
• Implemented a modal that accepts user rating input for the CMC.

Workload (preview) dashboard updates:

• Improved the Workload (preview) dashboard visual design.

Storage summary dashboard updates:

• Redesigned the Storage summary dashboard.

Added a Federated Analytics dashboard:

• Added a Federated Analytics dashboard that contains entitlement and usage metrics attributed to Data Scan Units (DSUs) for Federated Searches on external data sets

• Corrected a typo in an SPL query that populates a token. The CMC does not use this token in any panels so the typo does not impact performance.
• Fixed the issue that caused the Data quality dashboard to not correctly filter Splunk source types.
• Fixed an issue that caused the heavy forwarder status to be missing from the Forwarder dashboards.
• Fixed an issue that caused some CMC pages to throw 400 errors.
• Corrected the SPL query used for the Peak SVC Usage: By Process panel.
• Fixed an issue that caused filler gauge visualizations to display an error:
• Removed the limit value of 100 and labeled the Y axis instead in the Overall Peak SVC Usage panel in the Workload (preview) dashboard.
• We addressed the issue in Splunk Cloud Platform version 9.2.2403 that caused the Overview dashboard to display an invalid error message stating "inconsistent results". This error was caused by infix wildcard searches used by the CMC but did not impact performance or results.

• Removed a saved search that wrote data to an invalid index in Splunk Cloud Platform Classic Experience version 9.2.2403. This saved search is not in use by any CMC visualizations, so no dashboards are impacted.

• In Splunk Cloud Platform version 9.2.2403, the Overview dashboard might display an invalid error message stating "inconsistent results". This error is caused by infix wildcard searches used by the CMC but does not impact performance or results.

• Updated the Maintenance dashboard to identify and inform admins when maintenance does not impact any Splunk Cloud Platform services.
• Added text to inform admins that forward monitoring must be turned on to view the No. of missing forwarder panels in the Overview (preview) dashboard.
• Added a "last updated" timestamp to the Overview (preview) dashboard panel action items.

• Deleted the unused sim_forwarder_assets.csv lookup file to prevent replication errors.
• Fixed an issue that caused the "As of" timestamp in the Forwarders: deployment dashboard to not match the Forwarder Build Asset Table.
• Fixed an issue that caused the Workload (preview) dashboard to not maintain user selections when switching between tabs.

• In Splunk Cloud Platform version 9.2.2403, the Overview dashboard might display an invalid error message stating "inconsistent results". This error is caused by infix wildcard searches used by the CMC but does not impact performance or results.

• Removed reserved and internal forwarder IP values from the Forwarders: instance, Forwarders: deployments, and Forwarder versions dashboards. These IP values are filtered out from panel results in the Forwarders: deployments and Forwarder versions dashboards, and do not display in the Forwarders: instance dashboard.
• Updated the top navigation bar to behave consistently across pages.
• Added Splunk Forwarder version 9.3 to the list of supported forwarders.

• We added a preconfigured CMC Alert - 503 errors in the Alerts tab that notifies admins when the server returns a 503 error from attempting to process an HTTP Event Collector (HEC) request.

• Added the single-value SVC entitlement metric.
• Removed the indicator icon from the Overall ¥ Peak SVC usage metric to avoid associating SVC usage with severity and deployment health.
• Added a full preview disclaimer and link to the Splunk General Terms in dashboard banner tool tip.
• Adjusted the SPL query for the Overall workload ¥ Peak SVC usage > By process metric to be more granular so that the values add up to the overall usage number.
• Added a See documentation button that leads to the Workload (preview) dashboard documentation.

We made updates to the Overview (preview) dashboard:

• Removed the indicator icon from the Overall ¥ Peak SVC usage metric to avoid associating SVC usage with severity and deployment health.
• Added a full preview disclaimer and link to the Splunk General Terms in dashboard banner tool tip and.
• Hyperlinked only the dashboard names in the links to associated dashboards in the metric cards.
• Created an empty state that displays if the admin de-selects all metrics.

Other update:

• Added a pre-configured CMC alert that notifies admins when 50% or more of stack indexers are blocked from processing.

The Overview (preview) dashboard has the following updates:

• The dashboard displays a summary of your deployment's license entitlements and status indicators for each license entitlement metric.
• You can choose which metrics to display and prioritize using the Personalize feature.
• Each metric has an ellipses menu where you can access action items such as Refresh and Open in search.
• You can provide feedback to the Splunk CMC team using the Feedback button.

The Workload (preview) dashboard has the following updates:

• Top-level panels display peak overall, search, and indexing usage metrics.
• The dashboard displays granular information about SVC consumption from your deployment's workloads, processes, apps, users, searches, and more.
• Tooltips provide information for investigating spikes, suggested thresholds, links to documentation, and other relevant dashboards.
• Additional resources at the bottom of the dashboard help you investigate your SVC usage.
• You can provide feedback to the Splunk CMC team using the Feedback button.

• Fixed an issue that caused the Health dashboard data and configured alerts to not match. The CMC now uses macros to ensure the dashboard data matches the configured alerts.
• Fixed an issue that caused the deletion modal in the Maintenance dashboard Change freeze tab to not reset after deleting a change freeze and attempting to delete another one.

• Fixed an issue that caused the Forwarders: Instance dashboard to display Splunk Cloud Platform IP addresses.
• Swapped misplaced descriptions for the Peak SVC usage and Peak SVC usage as a percentage of allocated SVCs per tier panels in the Workload dashboard.

Workaround: Refresh the page after deleting a change freeze request.

Updated CMC to use some new icons.

• The HTTP event collector (HEC) dashboard displays 503 errors in the Errors panel.
• Changed saved search default permission settings from global to app.

• Fixed an issue that caused a bundle size limit error.
• Fixed an issue that caused the Start time field for rows with a calendar invite icon to increment by one hour whenever a row is clicked.
• Fixed an issue that caused the Total data scan entitlement panel in the Federated search for Amazon S3 dashboard to not display data if the value is greater than or equal to 1000.
• The sim_forwarder_assets.csv lookup file is now compressed and uses the file name sim_forwarder_assets.csv.gz.

• Viewing the Index details panel in the Storage summary dashboard, Indexes with events and total indexes in the Overview dashboard, and the Index detail dashboard requires the indexes_edit capability. This behavior is unintended and will be updated in a future release.

• Updated the Maintenance dashboard to show the actual duration of the maintenance window instead of the estimated duration.
• Updated the Splunk internal index details panel in the Searchable storage (DDAS) dashboard to display the default retention period for new internal indexes.

• Fixed an issue that could lead to inaccurate information in the Build Forwarder Assets Now dialog box in Forwarder Monitoring Setup.
  Note: After upgrading to CMC version 3.22.0, navigate to Forwarders then Forwarder monitoring setup. Select Rebuild forwarder assets to ensure the data displays accurately.
• Fixed an error that appeared in the Indexes with Events panel in the Overview dashboard on Victoria Experience deployments that have Federated Search enabled.
• Fixed an issue with the mobile toggle on Alerts dashboards not working as expected.
• Fixed an issue that caused some CMC dashboards to not respect user timezone preference.
• Fixed an issue that led to unexpected behavior for user-added alerts.
• Fixed an issue that caused the Daily license usage details panel in the Workload dashboard to display an error if you select just the previous day.

• Viewing the Index details panel in the Storage summary dashboard, Indexes with events and total indexes in the Overview dashboard, and the Index detail dashboard requires the indexes_edit capability. This behavior is unintended and will be updated in a future release.

• Fixed an issue that caused the Search usage statistics dashboard to falsely report real-time searches.
• Fixed a typo in the Estimated indexing rate panel in the Indexing performance dashboard.
• Fixed an issue that caused the Alerts dashboard to not display results if you have a custom alert with an empty Related dashboard field. We also fixed the Enabled column for custom alerts.
• Fixed an issue that caused the HTTP Event Collector (HEC) dashboard to not display tokens that contain spaces.
• Fixed an issue that caused the Peak SVC usage split by process panel in the Workload dashboard to not display expected results.

• Fixed an issue that caused a discrepancy between the dbinspect search results and the Health dashboard Bucket size and range details page.
• Fixed an issue that caused the Health and Overview dashboards to have overflowing text on narrow screens.
• Fixed an issue that caused Storage retention days to display incorrect values in the Searchable storage (DDAS) dashboard.
• Fixed an issue that caused the SVC usage per hour by top 10 apps panel in the Workload dashboard to not display stacked columns.

• If you have a custom alert with an empty Related dashboard field, the Alerts dashboard does not display results when you use the search function.
• The Peak SVC usage split by process panel in the Workload dashboard does not display the expected results.
  • Workaround: In the Peak SVC usage split by process panel, select Open in search and replace the search with the following to view the expected results:

| search index=summary source="splunk-svc-consumer" svc_usage=* [`sim_get_local_stack` | eval host="*.".stack.".*splunk*" | fields host]
| fillnull value="" svc_consumer process_type search_provenances search_type search_app search_label search_user unified_sid search_modes labels search_head_names usage_source
| eval unified_sid=if(unified_sid="",usage_source,unified_sid)
| stats max(svc_usage) as utilized_svc by _time svc_consumer search_type search_app search_label search_user search_head_names unified_sid process_type
| timechart span=1h sum(utilized_svc) by svc_consumer
| rename "data services" as "ingestion", "search" as "search"

• Fixed an issue that caused the Search seconds/Estimated SVC usage per hour panel in the Workload dashboard to not populate correctly when toggling between the View by selections.
• Fixed an issue that caused the Forwarder versions dashboard to incorrectly identify Edge Processor as a forwarder.