Humio Server 1.52.0 Preview (2022-08-09)
|Version||Type||Release Date||End of Support||Upgrades From||Data Migration||Config. Changes|
Bug fixes and updates.
Improvements, new features and functionality
Falcon Data Replicator
The feature flag for FDR feeds has been removed. FDR feeds are now generally available.
Fixed a broken link to the documentation for Message Templates and Variables when editing alerts and scheduled searches.
Automation and Alerts
A major change has been made to how alert queries are run in order to better reuse live queries when nodes are restarted in a Humio cluster. Find more details at Alerts.
defaultSharedTimeIsLiveinput field on the updateDashboard GraphQL mutation, in favor of
On cloud: added a configuration on dynamic identity providers to configure if users are allowed to be lazily created.
New dynamic configuration
MinimumHumioVersion, default value is
0.0.0, that allows setting a minimum Humio version that this cluster will accept starting on. This allows protecting against inadvertently later rolling back too far for some other feature to be turned on, that has an implied minimum version for support of that feature.
Improved warning message when using
limit=maxand the limit is exceeded.
Added support for writing
Hin place of minutes in the cron schedule of scheduled searches — see Cron Schedule Templates for details.
In case view is not found we will try to fixup the cache on all cluster nodes.
Added new system permission, PatchGlobal, enabling access to the global patch API.
Allow any root user and any user with the PatchGlobal permission to use the global patch API. Previously required using the server-local special bootstraps root token, that would be valid only on the local node, thus hard to use via a load balancer.
Permit the first character in the field name of a field being turned into a tag to be anything. If the first character does not match
[a-zA-Z]then strip that from the resulting tag name. This does not alter the set of allowed names for tags, but allows the field names being turned into tags to have any character as the leading one, e.g. permitting examples such as
*pathas field names to turn into the tag
With the new implementation for running alerts, alerts will now start faster after a node has been restarted, making it easier for alerts with a small search interval to be able to alert on events during the downtime.
When saving a parser, validate that the fields designated as tag fields have names that are valid as tag field names. Since packages with invalid parsers cannot be installed, if you have an invalid parser in a package, you will need to edit it to keep being able to install it.
Falcon Data Replicator
Fixed a bug where a dropdown for choosing a parser was not visible in a dialog when creating a new FDR feed.
Fixed an error when querying for actions in GraphQL on a deleted view.
Fixes a bug where a placeholder would appear for the region selector on the login pages, even though it itself wouldn't be shown since it has no configured regions.