Getting Data In

Upgrade to Splunk 6.3 on Windows is failing with no useful error messages

Path Finder

I'm upgrading our environment from 6.2.6 to 6.3.0 on Windows (2012 R2)
We have 1 x master, 3 x indexers and 1 x search head/deployment server.
Trying to upgrade the master first (nothing else has been upgraded yet)
Run the installer as the service account originally used.

The process runs for about 5 minutes, then says there was an error and rolls back the install.
The only log I can find is the migration log in splunk\var\log\splunk\ which is below and gives nothing useful.

Any ideas where I can find out what the error actually is to give me some chance of fixing it??

Migration Log File

Migrating to:
VERSION=6.3.0
BUILD=aa7d4b1ccb80
PRODUCT=splunk
PLATFORM=Windows-AMD64

Copying 'D:\Splunk\etc\myinstall\splunkd.xml' to 'D:\Splunk\etc\myinstall\splunkd.xml-migrate.bak'.

Checking saved search compatibility...

Handling deprecated files...

Checking script configuration...

Copying 'D:\Splunk\etc\system\local\indexes.conf' to 'D:\Splunk\etc\system\local\indexes.conf.old'.

Handling Windows scripted inputs...

Copying 'D:\Splunk\etc\myinstall\splunkd.xml.cfg-default' to 'D:\Splunk\etc\myinstall\splunkd.xml'.
Deleting 'D:\Splunk\etc\system\local\field_actions.conf'.
Moving 'D:\Splunk\share\splunk\search_mrsparkle\modules' to 'D:\Splunk\share\splunk\search_mrsparkle\modules.old.20151005-145756'.
Moving 'D:\Splunk\share\splunk\search_mrsparkle\modules.new' to 'D:\Splunk\share\splunk\search_mrsparkle\modules'.
The following apps might contain lookup table files that are not exported to other apps:

splunk_management_console

Such lookup table files could only be used within their source app.  To export them globally and allow other apps to access them, add the following stanza to each D:\Splunk\etc\apps\<app_name>\metadata\local.meta file:

[lookups]
export = system

For more information, see http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/SetPermissions#Make_objects_globally_....
Checking for possible UI view conflicts...
Deleted the Dash version of local/data/ui/nav/default.xml from the DMC.
DMC is in distributed mode. Nav bar updated.

"D:\Splunk\etc\auth\ca.pem": already a renewed Splunk certificate: skipping renewal
"D:\Splunk\etc\auth\cacert.pem": already a renewed Splunk certificate: skipping renewal
Clustering migration already complete, no further changes required.
**end of file**
0 Karma
1 Solution

Explorer

I cannot tell you how to fix this problem, but I can get you more clarity into what could be the issue.

  1. run the following from the following from an administrative command line - "msiexec /L*VX Splunk6-3_install.log /i splunk-6.3.0-aa7d4b1ccb80-x64-release.msi" *Make sure you are in the directory with the msi file.

That should create a more detailed MSI installation log file. Any installation issues should appear there.

Good luck.

View solution in original post

Explorer

I cannot tell you how to fix this problem, but I can get you more clarity into what could be the issue.

  1. run the following from the following from an administrative command line - "msiexec /L*VX Splunk6-3_install.log /i splunk-6.3.0-aa7d4b1ccb80-x64-release.msi" *Make sure you are in the directory with the msi file.

That should create a more detailed MSI installation log file. Any installation issues should appear there.

Good luck.

View solution in original post

Path Finder

Thanks for the tip - this extra debuging gave a link to another log file - C:\Users\#####\AppData\Local\Temp\splunk.log which showed it was failing the preflight checks because of a reference to a non existent script file.

Thanks
Capilarity

0 Karma