topic Re: Splunk 9 Universal Forwarder getting "[App Key Value Store migration] " error after upgrade from Splunk 8. in Splunk Enterprise

Splunk 9 Universal Forwarder getting "[App Key Value Store migration] " error after upgrade from Splunk 8.2.4

vksplunk1 — Tue, 20 Sep 2022 20:59:28 GMT

Hi ,

Splunk 9 Universal Forwarder getting "[app key value store migration collection data is not available] " error after upgrade from Splunk 8.2.4. Splunk is not starting

app key value store migration collection data is not available

Why is UF is looking for KV Store ?

Any suggestion to resolve it

Re: Splunk 9 Universal Forwarder getting "[App Key Value Store migration] " error after upgrade from Splunk 8.

isoutamo — Wed, 21 Sep 2022 09:13:37 GMT

this is a known issue on those 9.0.x UF even it's not documented on release notes!

You can try to add this to the server.conf

[kvstore] disabled = true

and test it this helps.

Anyhow there shouldn't be any kvstore running on UFs! It's only needed on search heads.

r. Ismo

Re: Splunk 9 Universal Forwarder getting "[App Key Value Store migration] " error after upgrade from Splunk 8.

likedasplunk — Wed, 04 Jan 2023 21:45:46 GMT

@isoutamo

I added that stanza to server.conf and I still get prompted for interactive login. No matter what I do or try, I still get prompted for Nix UF 9.0.3. Is there any update on this?