topic Re: Invalid message type: 28 during Splunk ES 7.1 Upgrade in Splunk Enterprise Security

Invalid message type: 28 during Splunk ES 7.1 Upgrade

youngsuh — Wed, 03 May 2023 16:22:43 GMT

Getting this error via UI upgrade to Splunk 7.1: Invalid message type: 28

We're on version 9.0.4. Previous upgrade work without this error using the UI.

Re: Invalid message type: 28 during Splunk ES 7.1 Upgrade

youngsuh — Wed, 03 May 2023 16:34:51 GMT

We deleted the /tmp to clear for the upgrade after failure. Did the CLI upgrade instead based on the documentation.

Upgrade Splunk Enterprise Security - Splunk Documentation

./splunk install app <path to app> -update 1 -auth <username>:<password>

Then we went the UI portion to finish the configuration. Watch the usual logs. Restarted the web UI.

Re: Invalid message type: 28 during Splunk ES 7.1 Upgrade

computermathguy — Fri, 25 Aug 2023 19:32:11 GMT

I just noticed the same type-28 error. Before this occurred, were getting a "500 Internal Server" error. We are on Splunk 9.0.5

Waiting to hear back from Splunk support if they can resolve the UI install issue with ES 7.1.1

Re: Invalid message type: 28 during Splunk ES 7.1 Upgrade

youngsuh — Tue, 28 May 2024 16:17:47 GMT

It appears the problem still around. I am upgrading to 7.3.1 and still getting the error. I had to use the CLI option to upgrade.