Crogl 2.12.1 Release Notes

Crogl 2.12.1 is a patch release for knowledge-graph learning on large Splunk deployments. The upgrade runs one small database migration automatically. Take your usual backup first.

What's New

• Splunk lookback setting. Limit knowledge-graph learning to the last 1, 3, 6, or 12 months (default 1). Investigation searches are unaffected.

Upgrade note: the first scan after upgrading drops sourcetypes with no events inside the window. If you rely on rarely written sourcetypes, set a longer window first.

Fixes

• Knowledge-graph scans complete on Splunk deployments that restrict bulk sourcetype listings. Jira bulk project listings get the same handling.
• Knowledge-graph scans keep what they learned when a Splunk search peer is slow or down.
• When Splunk refuses a search, the error Crogl shows now includes Splunk's reason.