Skip to main content
false

Splunk Support Policy


Splunk provides Support Services for Offerings as set out in the Splunk General Terms to Customers or applicable Partner Agreement to Partners (Partner to be defined as a “Customer” herein), with active subscriptions to a Support Program. All defined terms in the Splunk General Terms or Partner Agreement apply here as well. Offerings may comprise either or both On-Premise Products (“Products”) and Hosted Services Offerings (“Services”). This Policy details the timelines during which specific Product versions are eligible for Support Services, as well as other policies that determine eligibility of both Products and Services for Support Services.

Product Version Numbering

Each Product release is identified with a numerical version comprising three sets of digits separated by decimals. The digit(s) to the left of the first decimal represent the major version, the digit(s) to the right of the first decimal represent the minor version, and the digit(s) to the right of the second decimal represent the maintenance version. Any version number that specifies the second digit(s) is referred to as a minor version, even if it is the first release of a new major version. For example, 7.0, 7.1, and 7.2 are all minor versions of the 7.x major version.

For the purposes of determining which Offerings are supported ("Supported Version"), any maintenance release that may be provided for a given minor version is considered part of that version and does not alter the minor version release date.

Product Supported Version Timelines

Any given Product version is considered a Supported Version (“Supported”) for a finite period following its release. The particular timelines for each Product are detailed below for all recent Product versions. Note that any prior version of any of these Products not listed here is no longer Supported.

Support includes support for any version of commercial third-party components shipped with a Supported Version of a given Product, even if a particular version of a commercial third-party component has been deprecated or marked as end of life/support by the source developer or entity.

Once a Product version is no longer Supported, it is considered End of Support. End of Support Product versions are not eligible for Support Services, and any software, associated product documentation, and Splunk Extensions that are not compatible with Supported Versions will no longer be available to Customers.

Splunk Core Products

Splunk Enterprise (Version 7.0 Onward)

Splunk Light (Version 7.x Only)

Splunk Analytics for Hadoop

Splunk Data Fabric Search

Splunk Data Stream Processor

Each minor version of these Products is Supported for twenty-four (24) months from the release of that minor version.

Splunk Enterprise & Splunk Light (Version 6.x Only)

Each minor version of Splunk Enterprise 6.x and Splunk Light 6.x was Supported from release of that minor version through the October 22, 2019 release of Splunk Enterprise 8.0. All Splunk Enterprise 6.x and all Splunk Light 6.x versions are End of Support.

Splunk Universal Forwarder (Version 7.0 Onward)

Starting with version 7.0, each minor version of Splunk Universal Forwarder is Supported from release for a total of sixty (60) months. During the first twenty-four (24) months from release of each version, the targeted Support response times will be determined by issue severity and priority, per the terms of the Support Program purchased for the underlying paid Offering. For the subsequent thirty-six (36) months, the targeted Support response times will be limited to the P3 level.

Splunk Universal Forwarder (Version 6.x Only)

Each minor version of Splunk Universal Forwarder version 6.x was Supported from release of that minor version through the October 22, 2019 release of Splunk Universal Forwarder 8.0.

Universal Forwarder versions 6.3 through 6.6 only will be Supported at the P3 level through the June 4, 2021 End of Support of Universal Forwarder 7.3. All minor versions of Splunk Universal Forwarder prior to version 6.3 have reached End of Support.

Security Products

Splunk Enterprise Security

Each minor version of Splunk Enterprise Security is Supported for twenty-four (24) months from release of that minor version.

Splunk SOAR

Starting with version 4.10, each minor version of Splunk SOAR is Supported for twenty-four (24) months from the release of that minor version.

Splunk User Behavioral Analytics

Starting with version 5.1, each minor version of Splunk User Behavior Analytics is Supported for twenty-four (24) months from the release of that minor version.

Splunk Intelligence Management (TruSTAR legacy system)

Splunk support for the TruSTAR legacy system (including, the TruSTAR platform, TruSTAR Unified App, and TruSTAR App for SOAR) will end on June 30, 2025 (unless specified otherwise in customer’s terms).

Splunk Threat Intelligence Management functionality is now regionally accessible by eligible customers within Mission Control as an integrated service of Enterprise Security.

Splunk® Security for SAP® solutions

“Splunk Security for SAP solutions'' includes Splunk components “Splunk Security App for SAP solutions” and “Splunk Security Add-on SAP solutions”. “Splunk Security Add-on SAP solutions” includes the following SAP components (“SAP Components”):

  • SAP Enterprise Threat Detection (ETD) - OEM, and
  • SAP HANA, Runtime edition for Applications & SAP BW - New/Subsequent partial

Support for Splunk Security for SAP solutions is Supported for twenty-four (24) months (from the release of that minor version). The support for SAP components will end after twenty-four (24) months OR on Mar 31, 2026 whichever date comes earlier.

Splunk Asset and Risk Intelligence

Each minor version of Splunk Asset and Risk Intelligence is Supported for twenty-four (24) months from release of that minor version.

IT Products

Splunk IT Service Intelligence

Each minor version of Splunk IT Service Intelligence is Supported for twenty-four (24) months from release of that minor version.

Supported Splunk Extensions

Each minor version of Splunk Extensions (free or paid) listed on Splunkbase or other Splunk-branded marketplace as “Splunk Supported” is Supported for twenty-four (24) months from release of that version. Support response times for these Splunk Extensions (other than those designated by us as premium) will be targeted at the P3 level.

Offering Support Services Policies

Unsupported Customers and Offerings

Support Services are provided only to Customers with an active subscription to a Support Program, exclusively for Products or Services that are part of a Customer’s Offering, or for Supported Splunk Extensions used in conjunction with such Products or Services.

Unsupported Splunk and Third Party Extensions

No Support Services are provided for any Splunk Extension listed on Splunkbase or other Splunk-branded marketplace as “Not Supported” or “Developer Supported”, nor are Support Services provided for any Third Party or Customer Extension.

Support for Multiple Offerings

When two or more Products, or any combination of Products and Services, are operated together, the versions of all must be listed as compatible in the applicable Splunk product documentation to be eligible for Support Services. For example, the Splunk Product compatibility matrix is located here and Splunk Cloud compatibility requirements can be found here.

When two or more Products are operated together, Support Services will be provided only if all Product versions are Supported. We encourage Customers to use the latest version of our Products as much as possible.

Operating System Support Status

For all Products except Splunk Universal Forwarder, no Support Services will be provided for any Product version when deployed on an operating system version that is no longer under mainstream support from its respective vendor (regardless of whether that Product version is otherwise eligible for Support Services herein). Mainstream support in this context means the period during which the vendor makes full support generally available for the operating system version, including the regular release of product enhancements and defect and security fixes, and the provision of full technical support.

The following operating system policy applies to currently-Supported minor versions of Splunk Universal Forwarder only (notwithstanding the Supported Version Timeline detailed above for Splunk Universal Forwarder):

  • The targeted Support response times will be limited to the P4 level when Splunk Universal Forwarder is deployed on a compatible operating system version that is under any form of limited support from its vendor.
  • Limited support in this context means an operating system vendor-defined life cycle phase following a general support phase, during which product defect and/or security fixes, but not ongoing product enhancements, are offered. If an active support subscription from the vendor is required to receive those product defects and/or security fixes, Customers must have that active support subscription to be eligible for the above described P4 level Support Services.

Support Services eligibility for a Universal Forwarder minor version on an operating system version past the end of mainstream support ends the sooner of:

  • The End of Support of that Universal Forwarder minor version, per the standard timelines for that version, or
  • The end of Customer’s active subscription to the applicable vendor support offering, or
  • (12) twelve months from the vendor-declared end of life of that operating system version, even if the vendor continues to offer support programs for that operating system version beyond that date.

Japanese language technical support for Splunk Cloud Platform

Customers can purchase Japanese language support as an add on to their Splunk Cloud Platform Standard support contract. Once purchased, technical support in Japanese will cover P2, P3 and P4 issues and will be available during normal business hours of 9AM to 5PM Japan Standard Time on business days. For P2, P3 and P4 technical support issues outside of normal business hours, support will default to the English language.

All P1 issues, at all times, will default to the English language to ensure quick response and round the clock incident management.

Service levels for Japanese language support will follow the underlying support plan and can be found here. Japanese language support is available only for Splunk Cloud Platform and only for technical support issues. Issues not related to technical support (Example: Change requests, Entitlement queries etc.) will be answered in English only.

Core

Splunk Enterprise / Splunk Analytics for Hadoop / Splunk Light*
VersionRelease DateEnd of Support DateEnd of Support Criteria
6.0Oct 1 2013Oct 22 2019Splunk Enterprise 8.0 Release
6.1May 6 2014Oct 22 2019Splunk Enterprise 8.0 Release
6.2Oct 7 2014Oct 22 2019Splunk Enterprise 8.0 Release
6.3Sept 22 2015Oct 22 2019Splunk Enterprise 8.0 Release
6.4Apr 5 2016Oct 22 2019Splunk Enterprise 8.0 Release 
6.5Sept 27 2016Oct 22 2019Splunk Enterprise 8.0 Release 
6.6**May 2 2017Jan 31 2020Splunk Enterprise 8.0 Release
7.0**Sept 26 2017Jan 31 202024 Months
7.1**Apr 24 2018Oct 31 202024 Months
7.2***Oct 2 2018April 30 202124 Months
7.3****June 4 2019Oct 22 202124 Months
8.0Oct 22 2019Oct 22 202124 Months
8.1*****Oct 19 2020Apr 19 2023
24 Months
8.2******May 12 2021Sep 30 202324 Months
9.0Jun 14 2022Jun 14 202424 Months
9.1Jun 28 2023Jun 28 202524 Months
9.2Jan 31 2024Jan 31 202624 Months
9.3Jul 24 2024Jul 24 202624 Months


*Splunk Light EOL applies only for 6.0 - 7.3 The last minor version released and corresponding End of Support Date for Splunk Light is Version 7.3
**A Limited Support phase was provided for Splunk Enterprise 6.6 and 7.0 from the End of Support date through January 31, 2020. All Splunk Enterprise 6.x and 7.0 versions are now End of Support. The End of Support Date for Splunk Enterprise and Splunk Light 7.1 has been extended to October 31 2020 due to the global impact of COVID-19.
***The End of Support Date for Splunk Enterprise 7.2 has been extended to April 30 2021 due to the global impact of COVID-19.
****A Limited Support phase is being provided for Splunk Enterprise 7.3 from the End of Support date through Oct 22, 2021
*****The End of Support Date for Splunk Enterprise 8.1 has been extended to April 19 2023.
******The End of Support Date for Splunk Enterprise 8.2 has been extended to September 30, 2023.


 Splunk Universal Forwarder

Version Release Date End of Support Date End of P3 Support Date
6.0 Oct 1 2013 Oct 22 2019 Oct 22, 2019
6.1 May 6 2014 Oct 22 2019 Oct 22, 2019
6.2 Oct 7 2014 Oct 22 2019 Oct 22, 2019
6.3 Sept 22 2015 Oct 22 2019 June 4, 2021
6.4 Apr 5 2016 Oct 22 2019 June 4, 2021 
6.5 Sept 27 2016 Oct 22 2019 June 4, 2021 
6.6 May 2 2017 Oct 22 2019 June 4, 2021
VersionRelease DateEnd of Support DateEnd of Full Support CriteriaEnd of P3 Support DateEnd of P3 Support Criteria*
7.0Sept 26  2017Sept 26 201924 MonthsSept 26 202236 Months
7.1April 24 2018April 24 202024 MonthsApril 24 202336 Months
7.2*Oct 2 2018April 30 202124 MonthsOct 2 202336 Months
7.3**June 4 2019Oct 22 202124 MonthsJune 4 202436 Months
8.0Oct 22 2019Oct 22 202124 MonthsOct 22 202436 Months
8.1***Oct 19 2020Apr 19 202324 MonthsOct 22 202536 Months
8.2****May 12 2021Sep 30 202324 MonthsMay 12 202636 Months
9.0Jun 14 2022Jun 14 202424 MonthsJun 14 202736 Months
9.1Jun 28 2023Jun 28 202524 MonthsJun 28 202836 Months
9.2Jan 31 2024Jan 31 202624 MonthsJan 31 202936 Months
9.3Jul 24 2024Jul 24 202624 MonthsJul 24 202936 Months


*The End of Support Date for Splunk Universal Forwarder 7.2 has been extended to April 30 2021 due to the global impact of COVID-19.

**The End of Support Date for Splunk Universal Forwarder 7.3 has been extended to Oct 22 2021

***The End of Support Date for Splunk Universal Forwarder 8.1 has been extended to Apr 19, 2023.

****The End of Support Date for Splunk Universal Forwarder 8.2 has been extended to September 30, 2023.

Splunk Data Fabric Search

Version Release Date End of Support Date End of Support Criteria
1.0 June 4 2019 June 4 2021 24 Months
1.1 Oct 22 2019 Oct 22 2021 24 Months

Splunk Data Stream Processor

VersionRelease DateEnd of Support DateEnd of Support Criteria
1.0Oct 30 2019Oct 30 202124 Months
1.1May 08 2020May 08 202224 Months
1.2Oct 30 2020Oct 30 202224 Months
1.3Mar 30 2022Jul 01 2023*See note (*) below
1.4Feb 28 2023Feb 28 202524 Months


* The End of Support date for Splunk Data Stream Processor (DSP) 1.3 was March 30, 2024. However, all DSP releases prior to DSP 1.4 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4 before July 1, 2023 in order to continue to receive full product support from Splunk.

Security

Splunk Enterprise Security

VersionRelease DateEnd of Support DateEnd of Support Criteria
5.0Feb 20 2018Feb 20 202024 Months
5.1**May 14 2018Oct 31 202024 Months
5.2Oct 16 2018Oct 16 202024 Months
5.3Apr 4 2019Apr 4 202124 Months
6.0Oct 28 2019Oct 28 202124 Months
6.1Jan 23 2020Jan 23 202224 Months
6.2June 4 2020June 4 202224 Months
6.3Aug 29 2020Aug 29 202224 Months
6.4Dec 9 2020Dec 9 202224 Months
6.5Mar 1 2021Mar 1 202324 Months
6.6June 30 2021June 30 202324 Months
7.0Dec 16 2021Dec 16 202324 Months
7.1Jan 11 2023Jan 11 202524 Months
7.2Sept 7 2023Sept 7 202524 Months
7.3Dec 14 2023Dec 14 202524 Months
8.0Oct 31 2024Oct 30 202624 Months


**The End of Support Date for Splunk Enterprise Security 5.1 has been extended to October 31 2020 due to the global impact of COVID-19.

Splunk User Behavioral Analytics

VersionRelease DateEnd of Support DateEnd of Support Criteria
4.1May 24 2018Oct 16 2019Release of 5.0
4.2Oct 16 2018Jul 28 2022
Release of 5.1
4.3Mar 26 2019Feb 15 20232nd version after 5.0
5.0Oct 16 2019Aug 16 20233rd version after 5.0
5.1Jul 28 2022Jul 28 202424 Months
5.2Feb 15 2023Feb 15 202524 Months
5.3Aug 16 2023Aug 16 202524 Months
5.4May 8 2024May 8 202624 Months

Splunk SOAR

VersionRelease DateEnd of Support DateEnd of Support Criteria

3.5

Feb 22 2018

Sep 21 2021

Release of 5.0

4.0

Sep 3 2018

Sep 21 2021

Release of 5.0

4.1

Oct 1 2018

Sep 21 2021

Release of 5.0

4.2

Jan 30 2019

Sep 21 2021

Release of 5.0

4.5

May 31 2019

Sep 21 2021

Release of 5.0

4.6

Sept 30 2019

Sep 21 2021

Release of 5.0

4.8

Jan 30 2020

Feb 22, 2023

Release of 6.0

4.9

Jun 29 2020

Feb 22, 2023

Release of 6.0

4.10

Dec 9 2020

Dec 9 2022

24 Months

5.0

Sep 21 2021

Sep 21 2023

24 Months

5.1

Nov 11 2021

Nov 11 2023

24 Months

5.2

Jan 26 2022

Jan 26 2024

24 Months

5.3

April 4 2022

April 4 2024

24 Months

5.4

Oct 26 2022

Oct 26 2024

24 Months

5.5Jan 3 2023Jan 3 202524 Months
6.0Feb 22 2023Feb 22 202524 Months
6.1July 12 2023July 12 202524 Months
6.2Nov 30 2023Nov 30 202524 Months
6.3Sep 19 2024Sep 19 202624 Months

IT Operations

 Splunk IT Service Intelligence

VersionRelease DateEnd of Support DateEnd of Support Criteria
3.0Oct 20 2017Oct 20 2019EOS of Enterprise 7.0
3.1Apr 24 2018Apr 24 202024 Months
4.0**Oct 1 2018Jan 19 202124 Months
4.1Jan 19 2019Jan 19 202124 Months
4.2April 30 2019April 30 202124 Months
4.3July 17 2019July 17 202124 Months
4.4Oct 22 2019Oct 22 202124 Months
4.5Apr 29 2020Apr 29 202224 Months
4.6Aug 14 2020Aug 14 202224 Months
4.7Oct 28 2020Oct 28 202224 Months
4.8Jan 28 2021Jan 28 202324 Months
4.9Apr 29 2021Apr 29 202324 Months
4.10Aug 13 2021Aug 13 202324 Months
4.11Dec 8 2021 Dec 8 202324 Months
4.12Jan 25 2022 Jan 25 202424 Months
4.13May 16 2022 May 16 202424 Months
4.14Aug 8, 2022 Aug 8, 202424 Months
4.15Nov 15, 2022Nov 15, 202424 Months
4.16Feb 2, 2023Feb 2, 202524 Months
4.17Jun 13, 2023Jun 13, 202524 Months
4.18Jan 23 2024Jan 23 202624 Months
4.19May 28, 2024May 28, 202624 Months


**The End of Support Date for Splunk IT Service Intelligence 4.0 has been extended to January 19 2021 due to the global impact of COVID-19.

Last Updated: September 2024