Getting Data In

Upgrade to Splunk 6.3 on Windows is failing with no useful error messages

capilarity
Path Finder

I'm upgrading our environment from 6.2.6 to 6.3.0 on Windows (2012 R2)
We have 1 x master, 3 x indexers and 1 x search head/deployment server.
Trying to upgrade the master first (nothing else has been upgraded yet)
Run the installer as the service account originally used.

The process runs for about 5 minutes, then says there was an error and rolls back the install.
The only log I can find is the migration log in splunk\var\log\splunk\ which is below and gives nothing useful.

Any ideas where I can find out what the error actually is to give me some chance of fixing it??

Migration Log File

Migrating to:
VERSION=6.3.0
BUILD=aa7d4b1ccb80
PRODUCT=splunk
PLATFORM=Windows-AMD64

Copying 'D:\Splunk\etc\myinstall\splunkd.xml' to 'D:\Splunk\etc\myinstall\splunkd.xml-migrate.bak'.

Checking saved search compatibility...

Handling deprecated files...

Checking script configuration...

Copying 'D:\Splunk\etc\system\local\indexes.conf' to 'D:\Splunk\etc\system\local\indexes.conf.old'.

Handling Windows scripted inputs...

Copying 'D:\Splunk\etc\myinstall\splunkd.xml.cfg-default' to 'D:\Splunk\etc\myinstall\splunkd.xml'.
Deleting 'D:\Splunk\etc\system\local\field_actions.conf'.
Moving 'D:\Splunk\share\splunk\search_mrsparkle\modules' to 'D:\Splunk\share\splunk\search_mrsparkle\modules.old.20151005-145756'.
Moving 'D:\Splunk\share\splunk\search_mrsparkle\modules.new' to 'D:\Splunk\share\splunk\search_mrsparkle\modules'.
The following apps might contain lookup table files that are not exported to other apps:

splunk_management_console

Such lookup table files could only be used within their source app.  To export them globally and allow other apps to access them, add the following stanza to each D:\Splunk\etc\apps\<app_name>\metadata\local.meta file:

[lookups]
export = system

For more information, see http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/SetPermissions#Make_objects_globally_....
Checking for possible UI view conflicts...
Deleted the Dash version of local/data/ui/nav/default.xml from the DMC.
DMC is in distributed mode. Nav bar updated.

"D:\Splunk\etc\auth\ca.pem": already a renewed Splunk certificate: skipping renewal
"D:\Splunk\etc\auth\cacert.pem": already a renewed Splunk certificate: skipping renewal
Clustering migration already complete, no further changes required.
**end of file**
0 Karma
1 Solution

jcrensh
Explorer

I cannot tell you how to fix this problem, but I can get you more clarity into what could be the issue.

  1. run the following from the following from an administrative command line - "msiexec /L*VX Splunk6-3_install.log /i splunk-6.3.0-aa7d4b1ccb80-x64-release.msi" *Make sure you are in the directory with the msi file.

That should create a more detailed MSI installation log file. Any installation issues should appear there.

Good luck.

View solution in original post

jcrensh
Explorer

I cannot tell you how to fix this problem, but I can get you more clarity into what could be the issue.

  1. run the following from the following from an administrative command line - "msiexec /L*VX Splunk6-3_install.log /i splunk-6.3.0-aa7d4b1ccb80-x64-release.msi" *Make sure you are in the directory with the msi file.

That should create a more detailed MSI installation log file. Any installation issues should appear there.

Good luck.

capilarity
Path Finder

Thanks for the tip - this extra debuging gave a link to another log file - C:\Users\#####\AppData\Local\Temp\splunk.log which showed it was failing the preflight checks because of a reference to a non existent script file.

Thanks
Capilarity

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...