topic Re: Upgrade ES in Splunk Enterprise

Upgrade ES

jovnice — Thu, 05 Feb 2026 15:16:13 GMT

I would like to upgrade from 9.0.0 to 10.2.0 while keeping the same license. The license is Splunk Enterprise - No Enforcement. Also, my 9.0.0 is not working correctly. It states that I can't update the KV store, and I also get this error message: Could not load lookup=LOOKUP-splunk_security_essentials. Will an upgrade help with that?

Re: Upgrade ES

livehybrid — Thu, 05 Feb 2026 16:02:49 GMT

Hi @jovnice

Firstly, I dont think the upgrade should affect your license, so this shouldnt be an issue.

Regarding the KV Store update, if it was me I would focus on fixing this first before upgrading to 10.2.0.

You will need to upgrade from 9.0.x to 9.2.x and then 9.4.x before upgrading to 10.2.x (See https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.2/upgrade-or-migrate-splunk-enterprise/how-to-upgrade-splunk-enterprise) - This will ensure any iterative upgrade requirements like KV Store upgrades are met, but like I said - Start with a working system!

The splunk_security_essentials lookup could be related to the KV Store issue, Im not 100% where this comes from so I would fix the KV Store issue first.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Upgrade ES

jovnice — Thu, 05 Feb 2026 16:16:11 GMT

Thank you for the information. Is there any information on the KV store upgrade, or why it is not working?

Re: Upgrade ES

PickleRick — Thu, 05 Feb 2026 21:08:11 GMT

1. You're asking about Splunk Enterprise, not ES (which is Enterprise Security).

2. Well, without more info we can't know why your upgrade doesn't work. Maybe you skipped some versions before, maybe your kvstore database is corrupted. That's what the logs are for - see what's in them.

Re: Upgrade ES

jovnice — Fri, 06 Feb 2026 14:04:45 GMT

Yes, I mean SE (Splunk Enterprise). Thanks for responding.

I haven't tried the upgrade yet because I wasn't sure whether it would fix the kvstore database issue. I want to update once I know if it's working or if there is any documentation on the KVStore database.

Re: Upgrade ES

PickleRick — Fri, 06 Feb 2026 22:27:13 GMT

You can find bits and pieces about kvstore in Splunk docs. It's "just" a mongodb instance so much of mongodb experience applies here as well.

Re: Upgrade ES

kknairr — Sat, 07 Feb 2026 08:23:07 GMT

@jovnice Splunk Enterprise upgrade is not tied with your license, so you are good to proceed after fixing the issues in KV Store.

For KV Store issues in Splunk, check for errors or warnings in mongod.log file.

Located under the path :

$SPLUNK_HOME/var/lib/splunk/kvstore/mongo

I highly recommend you to collect these ERROR details and raise a Support case with Splunk before trying any remediation from your end since KV Store troubleshooting can be critical for the entire Splunk setup. Had few bad experiences in the past with KV store troubleshooting and eventually contacted Splunk Support to recover.

For the Lookup error on Splunk Security Essentials, it could be related to either a corrupted or missing lookup file or running an app version not aligned with your current Splunk version, which is 9.0.0.

Hope this helps and happy to help if you have any further questions. 😊

> Marking the answer and giving Karma helps others find solutions faster!

Re: Upgrade ES

jovnice — Mon, 09 Feb 2026 17:26:23 GMT

I've been looking there, but I didn't see the issue I'm having, so I can't troubleshoot.

Re: Upgrade ES

jovnice — Mon, 09 Feb 2026 17:44:26 GMT

Thanks for your help. I will look into this further.

Re: Upgrade ES

kknairr — Sat, 14 Feb 2026 06:41:04 GMT

@jovnice Refer to my earlier response and let us know if that gives you direction.