topic Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0? in Splunk Search

Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

dflodstrom — Wed, 30 Sep 2015 18:48:12 GMT

After upgrading my lab to 6.3.0 the search heads are reporting this error when no index is explicitly supplied in the search

3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

    [INDEXER1] Could not find an index named "_blocksignature".

I checked the spec file for indexes.conf and there is no mention of _blocksignature in the latest version, it does exist in earlier versions though. I tried to create the index and received this error from my master node

In handler 'clustermastercontrol': The Master could not push the latest configuration bundle because it contains an invalid configuration. Fix any errors and push the bundle again. Alternatively, you can skip the validation process like this: "splunk apply cluster-bundle --skip-validation". Use this option carefully, as it can cause the master to push an invalid configuration to the peers. The following errors were encountered: Invalid stanza [_blocksignature] in /opt/splunk/etc/master-apps/_cluster/local/indexes.conf, line 1. The block-signing feature is no longer available in Splunk. Please remove stanza=[_blocksignature] from the indexes.conf. For further details, please refer to the related topic in the latest version of 'Securing Splunk' manual on docs.splunk.com.

Has anyone else experienced this? Any suggestions?

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

martin_mueller — Wed, 30 Sep 2015 20:02:53 GMT

Check if your role has that index as permission/default from your pre-upgrade settings.

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

dflodstrom — Wed, 30 Sep 2015 20:31:16 GMT

Thanks for the comment. I should have mentioned that I explored that possibility. My role searches all non-internal indexes by default and can search all internal and non-internal indexes.

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

maciep — Wed, 30 Sep 2015 20:54:03 GMT

just a thought,....you don't possibly have a copy of an older indexes.conf in a local directory somewhere on your search heads do you?

splunk btool indexes list _blocksignatrue --debug

also may be worth checking to see if it's specifically listed in an authorize.conf somewhere too? Not sure if that has an effect on search.

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

martin_mueller — Wed, 30 Sep 2015 21:02:45 GMT

Might be a job for grep:

grep -R _blocksignature /opt/splunk/etc

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

dflodstrom — Thu, 01 Oct 2015 15:00:22 GMT

The issue ended up being an outdated version of indexes.conf in /etc/slaveapps/_cluster/default/indexes.conf

Simply deploying the cluster bundle to your indexers after an upgrade should prevent/resolve this issue.

Thanks to everyone for the comments that lead me to my solution.

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

mhuang3 — Tue, 29 Sep 2020 16:03:54 GMT

I have the same problem, tried many debug commands and search hard here
But still can not find the answer
When run any search command on search bar then message shows
Said as you mentioned "[Indexer...] Could not find an index named "_blocksignature".
Did not find configuration file,etc/slaveapps/_cluster/default/indexes.conf
Only can find an conf file in etc/master-apps/_cluster/default/indexes.conf
indexes.conf contents are followings------
[main]
repFactor = auto
[history]
repFactor = auto
[summary]
repFactor = auto
[_internal]
repFactor = auto
[_audit]
repFactor = auto
[_thefishbucket]
repFactor = auto
[_telemetry]
homePath = $SPLUNK_DB/_telemetry/db
coldPath = $SPLUNK_DB/_telemetry/colddb
thawedPath = $SPLUNK_DB/_telemetry/thaweddb
repFactor = auto

this index has been removed in the 4.1 series, but this stanza must be

preserved to avoid displaying errors for users that have tweaked the index's

size/etc parameters in local/indexes.conf.

[splunklogger]
repFactor = auto

-----End of indexes.con
Any suggestion ?Thank you very much

Re: Why are my search heads looking for index _blocksignature after upgrading to 6.3.0?

mathew_eagles — Sat, 03 Mar 2018 01:28:48 GMT

mhuang3
Use btool to find it in one of your indexes conf files.
Try this command, it will tell you what file(s) contain _blocksignature.
./splunk cmd btool indexes list --debug | grep _blocksignature