Getting Data In

Upgraded universal forwarder from 5.2 to 6.5.0. Is it typical to receive a "parameter=tstatsHomePath not configured" error when upgrading and how to fix?

hartfoml
Motivator

I upgraded my Windows universal forwarder from 5.2 to 6.5.0. All I did was grab the installer from download and install on top of the older config. I am getting a fatal error on the "parameter=tstatsHomePath not configured" is this a typical issue with the upgrade? What should I put in for the tstatsHomePath on the universal forwarder? Should I change the config at the deployment server? for the nix app or any app that uses the os index? How come this didn't error out on any other index config file?

10-07-2016 09:26:18.372 -0500 WARN  IndexerService - Indexer was started dirty: splunkd startup may take longer than usual; searches may not be accurate until background fsck completes.
10-07-2016 09:26:18.372 -0500 ERROR IndexConfig - stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 FATAL IndexerService - Cannot load IndexConfig: stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 INFO  IndexerService - adjusting tb licenses
10-07-2016 09:26:18.372 -0500 ERROR IndexConfig - stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 FATAL IndexerService - Cannot load IndexConfig: stanza=os Required parameter=tstatsHomePath not configured
10-07-2016 09:26:18.372 -0500 INFO  IndexProcessor - Initializing: readonly=false reloading=false
0 Karma

wkupersa
Path Finder

I got a similar error when I accidentally put a state=disabled in my etc/apps/SplunkUniversalForwarder/local/app.conf

0 Karma

hartfoml
Motivator

Thanks you for the help @wkupersa. I will take a look at my app.conf to see if it might be disabled

0 Karma

koshyk
Super Champion

tstatsHomePath is Location where datamodel acceleration TSIDX data for this index should be stored and is mandatory.
to fix it,
- go to indexes.conf (in your custom app or any app which you configured indexes)
- on each individual index, put a new tstatsHomePath entry
- Put the same value as your hotPath (hope it has enough diskspace)
- distribute and restart

0 Karma

hartfoml
Motivator

@Koshyk Thanks for the answer this makes sence but the system is a universal forwarder and is not indexing any inputs. Why would I need to put in a TSIDX data path on a universal forwarder?

0 Karma

hartfoml
Motivator

Any help with this would be great. Do I still need a TSIDX entry in the index.conf on a UF

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...