topic Re: Splunk upgrade 9.3 to 9.4 mongodb error in Splunk Enterprise

Splunk upgrade 9.3 to 9.4 mongodb error

Warren_Laya — Mon, 27 Jan 2025 09:08:19 GMT

Hi All

Upgrading on prem from 9.3 to 9.4 and getting this error on mongod which Iv never had before:

The server certificate does not match the host name. Hostname: 127.0.0.1 does not match SAN(s):

This makes sense since I am using a custom cert and 127.0.0.1 isnt on it, the cert is a wildcard cert I use internally so messing with the hosts file wont work, is there a way to get mongod to either ignore the cer SAN's or to change the connect string for mongo so that its connecting to the FQDN rather than 127.0.0.1

Re: Splunk upgrade 9.3 to 9.4 mongodb error

dominikatvastli — Mon, 10 Feb 2025 11:43:57 GMT

I have the same issue

Re: Splunk upgrade 9.3 to 9.4 mongodb error

Warren_Laya — Tue, 11 Feb 2025 14:49:15 GMT

I dont have a resoluton here, this is the documentation and the issue is around certs but I still cant work out where im going wrong.

Upgrade the KV store server version - Splunk Documentation

Im just going to wait for a new version where this is resolved.

Re: Splunk upgrade 9.3 to 9.4 mongodb error

n8o — Wed, 26 Feb 2025 20:09:20 GMT

If you're still experiencing issues, please take a look here https://splunk.my.site.com/customer/s/article/KV-store-status-failed-after-upgrade-to-9-4

The suggestion of concatenating CA certs resolved the errors and Splunk was able to upgrade/initialize kvstore after a restart of splunkd.

Re: Splunk upgrade 9.3 to 9.4 mongodb error

myitlab42000 — Wed, 26 Feb 2025 23:46:15 GMT

hi,

i don't know if it is the same issue but could you check this requirements. For example, is your cpu supported avx / avx2 instructions, if yes, is it enabled ?

https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/MigrateKVstore

https://www.mongodb.com/docs/manual/administration/production-notes/

i hope this help

Re: Splunk upgrade 9.3 to 9.4 mongodb error

bluelobster — Fri, 07 Mar 2025 12:52:40 GMT

If you use Splunk Cloud, the issue might be related to the splunkclouduf.spl credential package. There is a workaround:

https://splunk.my.site.com/customer/s/article/KV-store-status-failed-after-upgrade-to-9-4

Be aware that you will have to combine these three certs (instead of the two included in the guide) in this order for the Find more Apps page to work properly:

$SPLUNK_HOME/etc/auth/appsCA.pem $SPLUNK_HOME/etc/auth/cacert.pem $SPLUNK_HOME/etc/apps/100_<stackname>_splunkcloud/default/<stackname>_cacert.pem

Re: Splunk upgrade 9.3 to 9.4 mongodb error

isoutamo — Sat, 08 Mar 2025 15:37:21 GMT

i think that this is the correct instruction for this case https://splunk.my.site.com/customer/s/article/KV-Store-Error-after-upgrading-Splunk-Enterprise

The issue is with server name, not with CA.

So try to disable sslVerifyServerName attribute like above instruction is guided.

r. Ismo