Where to find comparison between Splunk releases 6.2, 6.3, and 6.4?

[bkumarm]

Another release of Splunk is out today ...6.4.0
we are currently on 6.2
Can anyone help me with a table of comparison between 6.2, 6.3, and 6.4?
what are major features, updates, changes, ...etc?

We have got documents individually, which takes lot of time to go through. We need some quick reference that can help us decide and act immediately.

[peter_krammer]

I use the following Apps to compare the features of the Splunk Releases:
Splunk 6 Overview: https://splunkbase.splunk.com/app/1602/
Splunk 6.1 Overview: https://splunkbase.splunk.com/app/1773/
Splunk 6.2 Overview: https://splunkbase.splunk.com/app/1892/
Splunk 6.3 Overview: https://splunkbase.splunk.com/app/2828/
Splunk 6.4 Overview: https://splunkbase.splunk.com/app/3106/

And the Dashboards Example App has Tags for each example in which version it is supported:
https://splunkbase.splunk.com/app/1603/

[muebel · Accepted solution]

Hi bkumarm, as MuS mentioned, there isn't any such table. The best you can do is read the release notes for each version. Splunk usually will also do an announcement blog post that highlights the major functionality improvements.

http://docs.splunk.com/Documentation/Splunk/6.2.3/ReleaseNotes/MeetSplunk
http://docs.splunk.com/Documentation/Splunk/6.3.3/ReleaseNotes/MeetSplunk
http://docs.splunk.com/Documentation/Splunk/6.4.0/ReleaseNotes/MeetSplunk

My advice for upgrading is to get to the latest maintenance release at least for 6.2. If some of the features look useful for the 6.3 release, test first in a dev environment if you have one, and then upgrade in prod.

If some 6.4 features look REALLY enticing, you could upgrade to that version, but keep in mind that ".0" versions carry an added risk of bugs, and it might be better to hold off for at least the first maintenance release, which should be expect in something like 3-6 weeks.

Please let me know if this helps!

[bkumarm]

Hi Muebel,

Your suggestions are quite realistic and valuable. We did consider the option to continue with 6.2 releases. One of the change request that we need is expected to be released in 6.3.4 and that is why we have to upgrade.
meanwhile the 6.4 release came up and we had to evaluate this one too.

Thanks,
Bharat

[muebel]

hah, yeah bkumarm, Splunk will have a release every few weeks it seems, so by the time you've planned for one version, there is another couple versions out.

Please accept my answer if it works for you 😄

[MuS]

I just can give the advice to check http://docs.splunk.com/Documentation/Splunk/6.4.0/ReleaseNotes/MeetSplunk and compare it to older versions .... or get the app https://splunkbase.splunk.com/app/1818/ and compare the different versions in Splunk 😉

cheers, MuS

[DavidHourani]

lol i updated and my splunk is dead ^^

[bkumarm]

Hi David,
could you put some more details? which version did u upgrade from and to?
where you able to identify and resolve the issue? if so what was the issue?
what are the symptoms for diagnosis of failure?
Thanks,
Bharath

[DavidHourani]

I was on Splunk 6.2.2 (on a lab env), didn't go to 6.3 just made a straight jump to 6.4 everything seemed to be working fine ( no errors during the upgrade) then when i tried to logon to splunk i got to the login page -> set username +password and then instead of going to the home page i fell on a error page (internal server error 500)

[bkumarm]

Where you able to find out what was the reason?
May be you could get some logs on splunkd.log or webaccesslog
curious to know why this failed?

[kvasudeva_splun]

Here's additional information on 500 Internal server error with 6.4 Release:

HTTPS_PROXY in splunk-launch.conf causes 500 Internal Server Error after login. To work around this issue:

Option 1: Export the following setting into your environment prior to starting Splunk Enterprise: NO_PROXY="127.0.0.1,localhost"

export NO_PROXY="127.0.0.1,localhost"

or add it to $SPLUNK_HOME/etc/splunk-launch.conf and restart Splunk Enterprise.

Option 2: Unset the proxy on the Linux system and restart Splunk Enterprise:

echo $http{,s}_proxy
unset $http{,s}_proxy

If the proxy is set in splunk-launch.conf but is not actually used or needed, remove the setting and restart.