Humio Server 1.42.0 Stable (2022-06-17)
|Version||Type||Release Date||End of Support||Upgrades From||Data Migration||Config. Changes|
|Docker Image||SHA256 Checksum|
These items have been deprecated and may be removed in a future release:
The Feature Flag, CookieAuthServerSide, has been deprecated as cookie authentication is now enabled by default. Instead, the configuration field
ENABLE_BEARER_TOKEN_AUTHORIZATIONhas been introduced.
The local disk based backup feature described at Making Back-Ups is deprecated, and is planned for removal in September 2022. We have found that restoring backups using this feature is difficult in practice, it is not commonly used, and the backup/restore functionality is covered by the bucket storage feature as well. For these reasons, we are deprecating this feature in favour of bucket storage.
DELETE_BACKUP_AFTER_MILLISconfiguration parameter, which controls the delay between data being deleted in Humio and removed from backup, will be retained, since it controls a similar delay for bucket storage. Customers using local disk based backups should migrate to using bucket storage instead. Systems not wishing to use a cloud bucket storage solution can keep backup support by instead installing an on-prem S3- or GCS-compatible solution, such as MinIO.
Improvements, new features and functionality
Falcon Data Replicator
Improved error logging, when an FDR feed fails to download data from an S3 bucket. It now clearly states when a download failed because the S3 bucket is located in a different region than the SQS queue.
fdr-invisible-message-countmetric, which contains the approximate number of invisible messages on an FDR feed's SQS queue.
fdr-message-countmetric, which contains the approximate number of messages on an FDR feed's SQS queue.
The Fields Panel now enables you to fetch fields beyond those from the last 200 events — see Adding and Removing Fields.
The Format Panel is now available for changing the style of the data displayed in the Event list — see Changing the Data Display.
Improve the error message if Humio is configured to use bucket storage, but the credentials for the bucket are not configured.
Dashboards and Widgets
Gaugewidget is being deprecated in favour of the
Single Valuewidget. Configurations of the former widget are compatible with the latter. This means that persisted configurations of the Gauge widget (url / dashboard widgets / saved queries / recent queries) are still valid, but are visualised using the Single Value widget instead.
Single Valuewidget is now available. Construct a query which returns any single value, or use the
timeChart()query function to create a single-value widget instance with sparkline and trend indicators.
The Humio Log Collector can now be downloaded from the Organizational Settings page, see the Log Collector Documentation for a complete list of the supported logs formats and operating systems.
ioc:lookup()would sometimes give incorrect results when negated.
worldMap()will warn about licensing issues with IP database.
worldMap()accepts more magnitude functions, including percentile and anonymous functions.
sankey()now accepts more weight functions such as anonymous functions and percentile.
When cleaning up a deleted data space, don't error log if two nodes race to delete the data space metadata from global.
Fixed an issue where a scheduled search could trigger actions multiple times for the same time period if actions took a long time to finish.
Ensured that errors during view tombstone removal are logged and don't prevent the RetentionJob from performing other cleanup tasks.
Email actions can now add the result set as a
Logging to the humio-activity repository is now also done for events in sandbox repositories.
Fixed an underlying bug causing
addToExistingJob did not find the existing jobto be error logged unnecessarily. Humio may decide to fetch a segment from bucket storage for querying. If this decision is made right as the query is cancelled, Humio could log the message above. With this fix, Humio will instead skip downloading the segment, and not log the error.
Fixed an issue where Humio's Zookeeper monitoring page would show X/0 followers in sync.
Specifying a versionless packageId will load the newest version of that package.
Fixed an issue that if download of IOCs took more than an hour, Humio would indefinitely start a new download every hour which would eventually fail.