topic Re: Cannot run splunk 9.4.3 after install on Linux in Splunk Enterprise

Cannot run splunk 9.4.3 after install on Linux

GeneralBlack — Tue, 10 Jun 2025 16:29:34 GMT

Hello after I installed Splunk 9.4.3 on Linux (Ubuntu) I am unable to run it. When I try to start Splunk, it says the directory does not exist. When I found it in the directory, I prompted with a KVstore error message.

Any help is greatly appreciated and needed.

Re: Cannot run splunk 9.4.3 after install on Linux

sainag_splunk — Tue, 10 Jun 2025 17:45:58 GMT

@GeneralBlack Please work with splunk support, may be its missing the the mongod folder and it was not created after upgrade?

Re: Cannot run splunk 9.4.3 after install on Linux

livehybrid — Tue, 10 Jun 2025 20:24:12 GMT

Hi @GeneralBlack

Please could you share the full error you are getting?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Cannot run splunk 9.4.3 after install on Linux

GeneralBlack — Tue, 10 Jun 2025 20:59:02 GMT

Hello Sainag I've tried calling Splunk customer support and keep getting thwarted in circles via the automated calling system. I've watched multiple tutorials and even some specifically given by Splunk and still no luck.

Re: Cannot run splunk 9.4.3 after install on Linux

GeneralBlack — Tue, 10 Jun 2025 21:28:14 GMT

"KVStore version upgrade precheck FAILED!" is the error I received

Re: Cannot run splunk 9.4.3 after install on Linux

sainag_splunk — Tue, 10 Jun 2025 21:44:35 GMT

@GeneralBlack we might need to re-install the previous splunk version for this, best approach is to work with support.
https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.3/administer-the-app-key-value-store/migrate-the-kv-store-storage-engine#Upgrade_KV_store_server_to_version_4.2

Try this go to login.splunk.com > support > support portal > Need help? > Create a Case

if this Helps, Please Upvote

Re: Cannot run splunk 9.4.3 after install on Linux

GeneralBlack — Tue, 10 Jun 2025 21:57:23 GMT

Okay, I've followed the documentation for the kvstore upgrade and ensured I disabled it before as well as manually tried upgrading it still no luck. After removing mog and starting Splunk again I received the messages such a:

ERROR while running splunk-preinstall

"/opt/splunk/var/log/splunk"