Deployment Architecture

Splunk Search Head Cluster Upgrade

himanshu2
New Member

I have a 2 search heads in a Splunk SH cluster in the dev environment. Recently, I upgraded Splunk from 9.3.8 to 9.4.11 version but kvstore didn't came up which I believe most probably due to Splunk restart in between /both Splunk SHs were stopped at the same time during upgrade activity.

TO resolve kvstore issues, I took backup of mongo from /opt/splunk/var/lib/splunk/kvstore/ and then restarted Splunk in both the servers as well, but nothing helped.

I disabled kvstore because it was not getting upgraded to 7.0.28 version. Now, when I checked SH Cluster status, for one of the SH, it is stuck at last_conf_replication : Pending.

I understand, we should have at least 3 SHs in a cluster but this is for testing purposes only and it was working fine with 2 SHs in the past. 
How can I resolve the SH Cluster and kvstore issues in this case?
@PickleRick @gcusello 

himanshu2_0-1779087834120.png


The mongod.log contents in the SH, where I don't see pending status 

himanshu2_1-1779088000598.png

 

Labels (2)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @himanshu2 ,

please don't call people in questions!

Anyway, following the documentation, it's a known issue, you must follow the documentation during upgrade from 9.3.x to 9.4.x:

https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/administer-the-app-key-valu...

Ciao.

Giuseppe

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...