topic Re: Splunk upgrade failed from 7.0 to 8.0.2 in Installation

Splunk upgrade failed from 7.0 to 8.0.2

gauravmsharma — Wed, 30 Sep 2020 05:02:43 GMT

While upgarding to the lastest version i get below error while is start the service
Process: 25918 ExecStart=/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt (code=exited, status=2)
splunkd.service: control process exited, code=exited status=2

This is what the splunkd daemon error says:

An error occurred: Failed to run splunkd rest:

stdout:

stderr:splunkd: /opt/splunk/src/util/HttpClientRequest.cpp:1760: void HttpClientTransaction::_handleProxyConnect(): Assertion `_poolp->hasSslContext()' failed.
Dying on signal #6 (si_code=-6), sent by PID 26389 (UID 1002). Attempting to clean up pidfile

Anyone else seen this error before?

Re: Splunk upgrade failed from 7.0 to 8.0.2

richgalloway — Sat, 18 Apr 2020 12:27:09 GMT

Make sure all of the files in /opt/splunk are owned by the user running Splunk. Sign on as root and run chown -R splunk:splunk /opt/splunk.
Also, make sure to follow the upgrade instructions for all of the interim releases.

Re: Splunk upgrade failed from 7.0 to 8.0.2

gauravmsharma — Mon, 20 Apr 2020 07:33:52 GMT

Done that 🙂

Re: Splunk upgrade failed from 7.0 to 8.0.2

codebuilder — Mon, 20 Apr 2020 14:08:02 GMT

This is because you have a lingering Splunk process that is preventing your upgraded version from starting.

Manually stop all Splunk services (/opt/splunk/bin/splunk stop and/or systemctl splunk stop).
Then search for any lingering processes:
ps -ef |grep -i splunk

If any are found, terminate them manually:
kill -9

Then restart Splunk.

Re: Splunk upgrade failed from 7.0 to 8.0.2

codebuilder — Mon, 20 Apr 2020 14:16:46 GMT

BTW...this can happen for a number of reasons, but the most common I see is one version is configured to run under init.d and another under systemd.

Re: Splunk upgrade failed from 7.0 to 8.0.2

gauravmsharma — Mon, 20 Apr 2020 14:19:25 GMT

Sorry to say but this seems like a situation where the response seems been there , done that, kind of case :).
I have splunk installed as a service and service splunk stop works and all the process stops at once the output for ps -ef | grep -i splunk is none.
I am more keen to know more about this article here which describe my situation
https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/RunSplunkassystemdservice#Upgrade_considerations_for_systemd

Does anyone faced or elaborate on this section of the article.

Re: Splunk upgrade failed from 7.0 to 8.0.2

gauravmsharma — Mon, 20 Apr 2020 14:21:25 GMT

I don't think the latest version 8 is configured as init.d, coz my current version 7 is configured as systemd.
But thanks for the comment.

Re: Splunk upgrade failed from 7.0 to 8.0.2

codebuilder — Mon, 20 Apr 2020 14:34:01 GMT

The "service" command is just a wrapper for init.d.

The init.d vs systemd topic is a long running topic of frustration/confusion for many users and is discussed in countless threads on this forum.

Re: Splunk upgrade failed from 7.0 to 8.0.2

codebuilder — Mon, 20 Apr 2020 15:00:12 GMT

Also, this should help you configure Splunk to run on either flavor, based on your preference.
From your output, I can see that Splunk is running under systemd, and your "service" call is routing the command back to systemctl (which is expected behavior in Linux).

https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/RunSplunkassystemdservice#Configure_systemd_using_enable_boot-start