How to solve this Splunk upgrade error?

myskyvideo — Thu, 07 Jul 2022 14:46:17 GMT

Received the below error after answering "y" to Perform migration and upgrade without previewing configuration changes? [y/n] y.

-- Migration information is being logged to '/opt/splunk/var/log/splunk/migration.log.2022-07-06.23-37-40' --

Migrating to:
VERSION=9.0.0
BUILD=6818ac46f2ec
PRODUCT=splunk
PLATFORM=Linux-x86_64

Copying '/opt/splunk/etc/myinstall/splunkd.xml' to '/opt/splunk/etc/myinstall/splunkd.xml-migrate.bak'.

An unforeseen error occurred:

Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied: '/opt/splunk/etc/myinstall/splunkd.xml-migrate.bak'

Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1359, in <module>
sys.exit(main(sys.argv))
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1212, in main
parseAndRun(argsList)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1067, in parseAndRun
retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 293, in call
return self.func(args, fromCLI)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/control_api.py", line 35, in wrapperFunc
return func(dictCopy, fromCLI)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/_internal.py", line 189, in firstTimeRun
migration.autoMigrate(args[ARG_LOGFILE], isDryRun)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3158, in autoMigrate
comm.copyItem(PATH_SPLUNKD_XML, PATH_SPLUNKD_XML_BAK, dryRun)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli_common.py", line 1086, in copyItem
shutil.copy(src, dst)
File "/opt/splunk/lib/python3.7/shutil.py", line 248, in copy
copyfile(src, dst, follow_symlinks=follow_symlinks)
File "/opt/splunk/lib/python3.7/shutil.py", line 121, in copyfile
with open(dst, 'wb') as fdst:
PermissionError: [Errno 13] Permission denied: '/opt/splunk/etc/myinstall/splunkd.xml-migrate.bak'

Re: Splunk upgrade error

VatsalJagani — Thu, 07 Jul 2022 05:25:25 GMT

@myskyvideo - Very likely permission issue.

The <user> does not have ownership of the to /opt/splunk directory.

You can use chown -R <user>:<user-group> /opt/splunk command to achieve that.

Here <user> refers to the Linux username you are using to run Splunk service and splunk commands.

I hope this helps!!!

Re: Splunk upgrade error

PickleRick — Thu, 07 Jul 2022 06:20:27 GMT

Typically permission issues come from inconsistency in launching splunk and/or editing splunk files. If you switch between root and your $SPLUNK_USER a lot you're bound to sooner or later run the service with wrong user and have it create files/dirs with wrong ownership. Especially if you don't use systemd.

Re: How to solve this Splunk upgrade error?

myskyvideo — Fri, 08 Jul 2022 00:24:58 GMT

Correct, it was permission issue. I did change the ownership, restarted Splunk and the upgrade worked.

topic Re: Splunk upgrade error in Installation

How to solve this Splunk upgrade error?

Re: Splunk upgrade error

Re: Splunk upgrade error

Re: How to solve this Splunk upgrade error?