Deprecated and removed in version 10.0
This page lists features, computing platforms, and browsers for which Splunk Inc. has deprecated or removed support in this version of the Splunk platform.
What does "deprecated" mean?
Deprecated features, platforms, and browsers continue to work and Splunk supports them until support is removed. However, customers need to begin planning now for the future removal of support.
What does "removed" mean?
When Splunk removes support for a feature, platform, or browser it means that the feature, platform, or browser no longer works with the Splunk platform and customers must find an alternative.
Deprecated features in version 10.0
The following table summarizes the features that are deprecated. These features continue to be supported, but Splunk reminds customers that deprecated features might be removed in a future release.
| Newly deprecated in this version | What do I need to know? | First deprecated |
|---|---|---|
| Node.js | As of Splunk Enterprise 10.0, Node.js is deprecated and will be removed in a future release. Customers using apps dependent on Node.js will need to update their apps to bundle their own version of Node.js. Failure to do so may result in App/TA functionality degradation and unexpected behavior. For more information about the Node.js deprecation and updating your apps, see Node.js deprecation FAQ in Splunk Lantern. | 10.0.0 |
| Binary Python module usage in Splunk apps | Splunk intends to phase out the use of binary python modules in Splunk apps to enhance the platform's security and reliability for app development. We strongly encourage customers to update their apps to remove binary python modules, ensuring smoother upgrades to future Splunk Enterprise releases. | 10.0.0 |
| Running Splunk Enterprise as a root user on MacOS and Linux | Running Splunk Enterprise as a root user on MacOS and Linux is deprecated. Although this configuration choice continues to be available, it will be removed in a future release. | 10.0.0 |
The md5_checksum value | The md5_checksum value is replaced by the FIPS-compliant sha256_checksum value. | 10.0.0 |
| Newly disabled in this version | What do I need to know? | First deprecated |
|---|---|---|
| Hadoop Data Roll | The Hadoop Data Roll feature is disabled in Splunk Enterprise 10.0. | 9.4.0 |
| Deprecated version 1.0 endpoints for the Search API are now disabled by default | Select version 1.0 endpoints for the Search API have been deprecated and disabled, and will be removed in a future release. Customers and app developers should upgrade usage of these disabled endpoints to the new API version, Search API version 2.0. These new Semantic Versioned Rest API endpoints for search improve platform contracts and resiliency to platform updates. If your organization has business-critical apps that still need to use the disabled endpoints, you can turn them on for a limited time as a temporary fix. See Semantic API versioning in the Splunk Cloud Platform REST API Reference Manual. | Version 9.0.1 |
| Still deprecated in this version | What do I need to know? | First deprecated |
|---|---|---|
| Version 3.0 of the Secure Sockets Layer (SSL) and versions 1.0 and 1.1 of the transport layer security (TLS) network encryption protocols | SSL version 3.0 and TLS versions 1.0 and 1.1 are deprecated and might be removed in a future release. To connect Splunk components and services securely going forward, specify TLS version 1.2 in configuration files for those components. | Version 9.4.0 |
| Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards. | Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards is deprecated and will be removed in a future release. | Version 9.4.0 |
| Hadoop Data Roll | Apache Hadoop Data Roll is deprecated and will be removed in a future release. | Version 9.4.0 |
The spawn_process parameter | Do not use the Splunk platform REST API spawn_process parameter. It is deprecated and will be removed in a future release. | Version 9.3.0 |
| Splunk platform search execution methods | The phased_execution_mode setting is deprecated and should not be included in limits.conf configuration files. If the phased_execution_mode setting is specified, Splunk software displays a warning message instructing users to contact their administrator to delete the setting from their limits.conf file. | Version 9.2.0 |
The populate_lookup alert action | The legacy alert action, populate_lookup, is deprecated and will be disabled in a future release. Use the lookup alert action instead. Note: You can still attach a
lookup alert action to new saved searches even though the populate_lookup alert action is deprecated. | Version 9.2.0 |
The /services/search/commands REST API endpoint. | The undocumented /services/search/commands REST API endpoint is deprecated and will be removed in a future release. If you have been inadvertently using this endpoint, stop using it. | Version 9.2.0 |
| Versions 3.0 and lower of the Splunk-To-Splunk (S2S) Protocol | S2S V3 is deprecated and will be removed in a future release. S2S Protocol V3 is automatically upgraded to V4 by default, and a warning message is generated. | Version 9.0.0 |
The createrss command | The createrss command is deprecated and disabled by default. | Version 9.0.0 |
The _reload action with the rest search command | Use of the _reload action with the rest command is deprecated. Do not use the _reload action with the rest command. | Version 9.0.0 |
The $SPLUNK_HOME/bin/srm (secure remove file) binary executable file | This binary executable, which removes files securely using a number of algorithms, was added in the version 6.0 release so that Splunk Enterprise could comply with Common Criteria requirements. Current Common Criteria guidelines preclude the need for the file, thus it has been deprecated and will likely be removed in a future release. | Version 8.2.0 |
| Support of HTML dashboards | Support of HTML dashboards has been deprecated. Use Dashboard Studio to rebuild and configure dashboards. | Version 8.2.0 |
The msearch command | The msearch command is replaced with the mpreview command. | Version 8.1.0 |
The tscollect command | The tscollect command relies on time-series index (tsidx) files in namespaces that reside on individual search heads and are incompatible with search head clustering. This feature has been superseded by data models, which reside on the indexer and are more performant. Data models are accessible from any search head. See Accelerate data models in the Knowledge Manager Manual. | Version 7.3.0 |
literals.conf
| Use of literals.conf has been deprecated. Use messages.conf to modify notifications that display in Splunk Web. | Version 7.2.2 |
The static/app-packages endpoint | This endpoint has been deprecated and might be removed entirely in a future release. | Version 6.6.x. |
| Element-level refresh interval | The element-level refresh interval option <option name="refresh.auto.interval"> has been replaced with more robust refresh controls to set both the interval/delay as well as the display type. | Version 6.5.x |
| HeaderView and FooterView in the Splunk Web Framework | HeaderView and FooterView are replaced by LayoutView. | Version 6.5.x |
| Dashboard Framework: Dual support for option height configuration | Splunk has deprecated dual support for option height configuration as "100px" and "100". | Version 6.4.x |
Dashboard Framework: Selected attributes of <single>
| Splunk has deprecated the following attributes of <single>:
| Version 6.4.x |
Simple XML <seed> tag | In Simple XML <form></form> code blocks, use <initialValue> instead of <seed>. | Version 6.3.x |
Simple XML <option name = "previewResults"> tag | This tag has been deprecated and might be removed entirely in a future release. | Version 6.3.x |
| "Run a Script" alert action | Use the custom alert action framework introduced in Splunk platform 6.3. | Version 6.3.x |
Simple XML charting.axisLabelsY.majorLabelVisibility and charting.axisLabelsY.majorTickSize attributes of the <chart> tag | These attributes have been deprecated and might be removed entirely in a future release. | Version 6.3.x |
| Search Head Pooling over the Network File System (NFS) protocol | As an alternative, configure search head clustering. | Version 6.2.x |
| Simple XML row grouping | Row grouping is replaced by the <panel> node in Simple XML. | Version 6.2.x |
Simple XML <searchString>, <searchTemplate>, <searchName>, and <searchPostProcess> elements | These elements are replaced by the new <search> element. | Version 6.2.x |
Simple XML <earliestTime> and <latestTime> elements | These elements are replaced by <earliest> and <latest> elements. | Version 6.2.x |
Simple XML <populatingSearch> and <populatingSavedSearch> elements | These elements are replaced by the <search> element. | Version 6.2.x |
Simple XML link attributes <link field="..."> and <link series="..."> used in drilldown to constrain an action to a certain field | These elements are replaced by the <condition field="..."> element. | Version 6.2.x |
The datamodel/acceleration REST endpoint | This endpoint has been deprecated and might be removed entirely in a future release. | Version 6.1.x |
license_audit.log
| Use license_usage.log instead. | Version 6.0.x |
The SplunkLightForwarder app | Use a universal forwarder instead. If you are using an app that still requires the light forwarder, see Deploy a light forwarder in the Forwarding Data manual. | Version 6.0.x |
Pre-trained CSV and IIS sourcetypes using the CHECK_FOR_HEADER attribute | Use the INDEXED_EXTRACTIONS and associated attributes instead. | Version 6.0.x |
The ability to deploy in multi-tenant environments using tenants.conf on a deployment server | This feature has been deprecated and might be removed in a future release. | Version 6.0.x |
| The capability for a deployment server to be a deployment client of itself | This feature was disabled in version 6.0.x. It is deprecated and might be removed in a future release. | Version 6.0.x |
| FSchange monitor | Use auditd and monitor the file output on *nix, or enable auditing of the Security Event Log and monitor file access events on Windows. See Monitor file system changes in Getting Data In. | Version 5.x |
| Saved searches used within event types | This feature has been deprecated and might be removed in a future release. | Version 5.x |
| Event type auto-discovery | This feature has been deprecated and might be removed in a future release. | Version 5.x |
| Distributed block signing and event hashing | This feature has been deprecated and might be removed in a future release. | Version 5.x |
CHECK_FOR_HEADERprops.conf attribute (for index-time field extractions) | This feature has been deprecated and might be removed in a future release. | Version 5.x |
entity.setEntity Python SDK function | This feature has been deprecated and might be removed in a future release. | Version 5.x |
The setfields command | The setfields command is deprecated. | Version 5.x |
The folderize command | The folderize command is deprecated. | Version 4.2 |
Removed features in version 10.0
Splunk has removed or removed support for the following features in version 10.0. Customers must immediately find alternatives.
| Removed in this version | What do I need to know? | First deprecated |
|---|---|---|
enable_show_hide setting
|
During its initial rollout, the enable_show_hide setting turned on or off the ability to hide panels in Dashboard Studio. The setting is now removed, and the panel show-hide feature remains in Dashboard Studio.
|
10.0 |
| Hybrid search support is removed. | Hybrid search reached end-of-life on October 30, 2024 and is no longer a supported feature. Customers must migrate to Federated Search for Splunk.
See Migrate from hybrid search to Federated Search for Splunk in Federated Search. |
Version independent |
| Removal of the Python 3.7 runtime environment. | Splunk has removed the Python 3.7 runtime environment from Splunk Enterprise. Customers must upgrade their apps to use Python 3.9 before upgrading to Splunk Enterprise 10.0, as 3.9 is the only available Python interpreter in that release. All Splunk and Developer owned Apps / TAs should be upgraded to "Splunk 10" supported versions as indicated on Splunkbase. Failure to do so may result in App / TA functionality degradation and unexpected behavior. | Version 9.4.0 |
Platform support changes in version 10.0
The following tables summarize the deprecation and removal of support for specific operating systems and file systems in this version of Splunk Enterprise.
For complete information on supported platforms, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.
Deprecated operating systems in version 10.0
The following table summarizes the deprecated operating systems in this version of Splunk Enterprise. A blank cell or an unlisted operating system indicates there is no change to support in this version.
| Operating system | Splunk Enterprisewith an Enterprise license | Splunk Enterprisewith a Free or Trial license | Universal forwarder |
|---|---|---|---|
| Ubuntu 20.04 | Deprecated | Deprecated | Deprecated |
| Amazon Linux 2 (x86 64-bit) | Deprecated | Deprecated | Deprecated |
| Amazon Linux 2 ARM (64-bit) | Deprecated | ||
| SLES 15 SP5 | Deprecated | Deprecated | Deprecated |
| raspi4 Ubuntu 20.04 | Deprecated |
Removed operating systems in version 10.0
See System requirements for use of Splunk Enterprise on-premises for information on the operating systems and distributions that are supported in this version of Splunk Enterprise as of its release date.
Deprecated CPU architectures in version 10.0
None.
Removed CPU architectures in version 10.0
None.
Deprecated file systems in version 10.0
None.
Removed file systems in version 10.0
None.
Browser support changes in version 10.0
The following sections summarize the deprecation and removal of support for specific browsers in this version of the Splunk platform.
Deprecated browser support in version 10.0
None.
Removed browser support in version 10.0
None.