Getting Data In

Upgrading Splunk from 6.2.3 to 6.2.5 on Windows, why is the installation hanging?

domenico_perre
Path Finder

Hi All,

I am attempting to upgrade Splunk from 6.2.3 to 6.2.5. I have followed the URL below and have started updating my Splunk Deployment server.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Upgradeacluster#Upgrade_to_a_new_maintenan...

I have set the deployment server to maintenance mode and can see this in splunkd.log

The migration.log file has the following at the start.
Migrating to:
VERSION=6.2.5
BUILD=272645
PRODUCT=splunk
PLATFORM=Windows-AMD64

Splunk looks to go through the start of the install and then gets to the point where it has stopped the service and is updating something, but there are no visual queues that something is moving or happening. Event logs aren't updating, no logs in the splunk/var/logs are updating.

I am stumped on what I should do.

Server is Windows 2012 x64.

Old version is splunk-6.2.3-264376-x64-release new version is splunk-6.2.5-272645-x64-release
I have disabled AV just in case that was interfering.

Anywhere I can look that may give me some help.

0 Karma
1 Solution

domenico_perre
Path Finder

So the answer was in my last comment.

Once I updated the file local.meta underneath splunk_management_console metadata with

[lookups]
export = system.

Then rerun the install it worked.

View solution in original post

domenico_perre
Path Finder

So the answer was in my last comment.

Once I updated the file local.meta underneath splunk_management_console metadata with

[lookups]
export = system.

Then rerun the install it worked.

domenico_perre
Path Finder

Some extra information that may aid someone in giving me an answer.

I ran the msi in verbose mode so I could see where it is getting stuck and here is what it shows in the last lines.

FirstTimeRun: Warning: Invalid property ignored: FailCA=.
FirstTimeRun: Info: Properties: splunkHome: C:\Program Files\Splunk.
FirstTimeRun: Info: Execute first time run.
FirstTimeRun: Info: Enter. Args: "C:\Program Files\Splunk\bin\splunk.exe", _internal first-time-run --answer-yes --no-prompt
FirstTimeRun: Info: Execute string: cmd.exe /c ""C:\Program Files\Splunk\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\username\AppData\Local\Temp\splunk.log" 2>&1"

Then it hangs after this.

Looking in the splunk.log after that it shows the following error and the only error I can find

Generating RSA private key, 1024 bit long modulus

.......................................++++++

....................................................................................++++++

unable to write 'random state'

e is 65537 (0x10001)

writing RSA key

....snip

Then at the bottom.
The following apps might contain lookup table files that are not exported to other apps:

splunk_management_console

Such lookup table files could only be used within their source app. To export them globally and allow other apps to access them, add the following stanza to each C:\Program Files\Splunk\etc\apps\metadata\local.meta file:

[lookups]
export = system

For more information, see http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/SetPermissions#Make_objects_globally_....
Splunkd: Stopped
Copying 'C:\Program Files\Splunk\etc\myinstall\splunkd.xml' to 'C:\Program Files\Splunk\etc\myinstall\splunkd.xml-migrate.bak'.

I have Created a distributed management console a while ago and did no update the default.meta file.

After updating the file as mentioned the install worked.

0 Karma

ppablo
Retired

Hi @domenico_perre

So at the bottom of your comment, you said you updated the default.meta file and the installation worked. Is your issue resolved then?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...