Skip to main content
Lantern Home

 

Splunk Lantern

Upcoming changes for Splunk Enterprise version 10.6 and Splunk Cloud Platform version 10.6

  1. Last updated
  2. Save as PDF

This article provides a summary of changes to Splunk Enterprise and Splunk Cloud Platform coming in version 10.6 (collectively, "Splunk platform 10.6" for the rest of this document). The article includes detailed information about the nature of these changes, the parties that the changes affect, and any necessary mitigation strategies. The objective of this article is to help you plan and act promptly.

Potentially breaking changes

Customers and app developers alike should carefully review all changes in this section as you prepare to migrate to Splunk platform 10.6 since there is a potential for disruption.

Analytics Workspace removal

Summary: Splunk has removed Analytics Workspace from the Splunk platform.

Overview: Analytics Workspace was a feature that comes with the Splunk platform. Splunk has removed this feature from the Splunk platform as of version 10.6. Users can no longer use it to visualize metrics and must instead create metrics searches using Search Processing Language (SPL). Classic Dashboards with Analytics Workspace panels will now open in the Search and Reporting app instead.

Affected customers: Splunk Enterprise and Splunk Cloud Platform customers that use Analytics Workspace for metrics visualization, and users with Classic Dashboards that contain Analytics Workspace panels.

Issue detection and mitigation guidance: Create SPL queries and visualizations for metrics index data manually in Search or dashboards.

Removal of TLS protocol version 1.0 and 1.1 support

Summary: Splunk Enterprise no longer supports TLS protocol versions 1.0 or 1.1.

Overview: Splunk Enterprise version 10.6 removes support for Transport Layer Security (TLS) protocol versions 1.0 and 1.1 (TLS 1.0/1.1) for network connections to and from Splunk nodes. Inter-Splunk connections that use TLS 1.0 or TLS 1.1 will no longer establish. Even if a customer includes TLS 1.0 or TLS 1.1 as values for the sslVersions setting in various configuration files, the configurations will no longer have an effect. Customers must use TLS 1.2 or TLS 1.3 for inter-Splunk network connections instead.

Affected customers: Splunk Enterprise customers, admins, forwarder/indexer operators, and any deployment that still uses TLS 1.0 or TLS 1.1 for communications between Splunk platform nodes.

Issue detection and mitigation guidance: Migrate affected connection configurations to use TLS 1.2 or TLS 1.3 before starting an upgrade.

Federated Search strict mode heartbeat verification enforcement

Summary: Federated Search heartbeat verification for remote search heads transitions from audit mode to strict mode. In strict mode, federated search heads that run version 10.6 or higher refuse connections from remote search heads that run a Splunk platform version below 10.4.

Overview: Starting in Splunk platform version 10.6, Federated Search heartbeat verification for remote search heads transitions from audit mode to strict mode. In strict mode, federated search heads that run version 10.6 or higher refuse connections from remote search heads that run a Splunk platform version below 10.4. Before upgrading to version 10.6, either upgrade remote search heads to version 10.4 or higher or configure your federated search head to use audit mode for heartbeat verification.

Affected customers: Splunk Federated Search customers with remote search heads that run a Splunk platform version below 10.4.

Issue detection and mitigation guidance:

On Splunk Cloud Platform:

  1. Prior to the 10.6 upgrade, Splunk will automatically configure federated search heads to audit mode for all customers that run a remote search head version below 10.4.
  2. In the event of post-upgrade impact, Splunk will revert federated search heads back to audit mode.
  3. After release, Splunk will engage with customers that run federated search heads in audit mode to upgrade remote search heads to version 10.4 or higher.
  4. Splunk will periodically monitor Splunk Cloud Platform deployments in audit mode and transition them to strict mode after their remote search head version reaches 10.4 or higher.

On Splunk Enterprise, configure federated search heads to use audit mode for remote search head heartbeat verification by editing the federated.conf configuration file on the federated search head and giving the providerVerificationMode setting a value of either auto or audit.