topic Re: Issue after updating to Splunk Enterprise 9.1.1 in Splunk Enterprise

Why are there Issues after updating to Splunk Enterprise 9.1.1?

TheExpert — Mon, 18 Sep 2023 21:59:47 GMT

Hi all,

today I updated Splunk enterprise from 9.0.5 to 9.1.1. Since the update I see the folliwing messages on the start page:

"Laden der App-Liste nicht möglich. Aktualisieren Sie die Seite, um den Vorgang zu wiederholen."

and

"Laden von gemeinsamen Aufgaben nicht möglich. Aktualisieren Sie die Seite, um den Vorgang zu wiederholen."

Reloading the page doesn't solve the issue. A reboot of Windows where Splunk is installed doesn't help either.

Splunk seems to work fine. But do you have any ideas how to solve the issue?

Thank You.

Re: Issue after updating to Splunk Enterprise 9.1.1

isoutamo — Fri, 01 Sep 2023 10:29:31 GMT

Have you checked that your Windows version is supported by Splunk 9.1.1?

As you could see from https://docs.splunk.com/Documentation/Splunk/9.1.1/ReleaseNotes/Deprecatedfeatures#Removed_features_in_version_9.1

Windows 2016 has removed from supported OS version.

r. Ismo

Re: Issue after updating to Splunk Enterprise 9.1.1

TheExpert — Fri, 01 Sep 2023 10:53:51 GMT

Thank you. And what about Windows 10 22H2? Looking on the download page this OS release is still supported:

Re: Issue after updating to Splunk Enterprise 9.1.1

isoutamo — Fri, 01 Sep 2023 12:16:06 GMT

https://docs.splunk.com/Documentation/Splunk/9.1.1/Installation/Systemrequirements#Windows_operating_systems told supported OS versions.

Re: Issue after updating to Splunk Enterprise 9.1.1

TheExpert — Fri, 01 Sep 2023 17:17:37 GMT

So I've running Splunk Enterprise on a supported system, Windows 22H2, 64 Bit.

But how can I solve the issue regarding the app and task list?

Re: Issue after updating to Splunk Enterprise 9.1.1

isoutamo — Fri, 01 Sep 2023 20:27:54 GMT

Did you found anything from splunkd.log or _internal index?

Re: Issue after updating to Splunk Enterprise 9.1.1

TheExpert — Fri, 01 Sep 2023 21:47:40 GMT

What should I search for in splunkd log? And how can I check _internal index?

Re: Issue after updating to Splunk Enterprise 9.1.1

isoutamo — Mon, 04 Sep 2023 12:20:07 GMT

Anything what could related to that error/warning.

From _internal logs you could try e.g.

index=_internal sourcetype=splunkd source=*/splunkd.log ERROR OR WARN

select suitable time for search e.g. when you have started splunk.

Re: Issue after updating to Splunk Enterprise 9.1.1

TheExpert — Mon, 04 Sep 2023 12:52:08 GMT

Thank you. In splunkd log there are so many errors. I'm wondering that Splunk is working. But this is not related to the newest update. I see that these errors were also logged in the previous release. But I don't find errors related to this issue.

With

index=_internal sourcetype=splunkd source=*/splunkd.log ERROR OR WARN

I also don't find any errors or warnings.

Re: Issue after updating to Splunk Enterprise 9.1.1

TheExpert — Sun, 17 Sep 2023 19:56:56 GMT

Hi all,

today I tried to reinstall Splunk but this doesn't solve the issue.

Then I uninstalled Splunk with losing all data. So I installed Splunk again but then all settings were lost. I restored the data, apps and settings from my backup. After some issues with the certificates and the admin password I was able to get Splunk running without issues.

But the data inputs weren't configured. So I restored the inputs.conf of the search app where the data inputs are configured. After restarting Splunk the issue came back again and for my surprise there was no login as admin anymore. Before I had to login with the admin user after each restart of Splunk.

Deleting the inputs.conf doesn't help.

So I have now researched for many hours without resolving the issue and I've lost data of a day :-(.

Can anyone assist, please?

Thank You.

Re: Issue after updating to Splunk Enterprise 9.1.1

isoutamo — Mon, 18 Sep 2023 08:06:22 GMT

Probably the easiest way is go back to situation when you have done fresh installation and everything is working. Then just add inputs one by one and see which one broke your environment.

This is annoying and long time taking process, but still I thing that this is the easiest way.

Re: Issue after updating to Splunk Enterprise 9.1.1

TheExpert — Mon, 18 Sep 2023 09:30:37 GMT

I don't understand what the inputs have to do with the issues on web UI of Splunk. And before the update to 9.1.1 there were no issues like these. I think there's a bug with 9.1.1 causing these issues.

If there would be a way to rollback by changing the inputs.conf file I would be fine testing this again. But repeating all the steps I had done yesterday is indiscutable. This is time wasting!

Re: Why are there Issues after updating to Splunk Enterprise 9.1.1?

TheExpert — Tue, 23 Jan 2024 23:00:27 GMT

With the update to Splunk enterprise 9.1.3 everything is looking fine. There are no more

messages on the start page:

"Laden der App-Liste nicht möglich. Aktualisieren Sie die Seite, um den Vorgang zu wiederholen."

and

"Laden von gemeinsamen Aufgaben nicht möglich. Aktualisieren Sie die Seite, um den Vorgang zu wiederholen."

Re: Why are there Issues after updating to Splunk Enterprise 9.1.1?

TheExpert — Tue, 13 Feb 2024 07:57:25 GMT

And with the update to Splunk Enterprise 9.2.0 the issue came back again :-(.

Re: Why are there Issues after updating to Splunk Enterprise 9.1.1?

isoutamo — Tue, 13 Feb 2024 17:44:01 GMT

Please create a support ticket to splunk.

Re: Why are there Issues after updating to Splunk Enterprise 9.1.1?

TheExpert — Tue, 13 Feb 2024 18:16:08 GMT

I'm a user of the free Community Edition. So I can't open support tickets, right?

Re: Why are there Issues after updating to Splunk Enterprise 9.1.1?

isoutamo — Tue, 13 Feb 2024 18:53:36 GMT

Unfortunately that’s true.

Re: Why are there Issues after updating to Splunk Enterprise 9.1.1?

TheExpert — Thu, 28 Mar 2024 16:22:22 GMT

With Splunk Enterprise 9.2.1 there's no issue any more. This issue is defintively related to the builds of Splunk Enterprise.