Installation

After upgrading Splunk from 6.3.3 to 6.4.0, why does Splunk not start with error "Can't create directory "": No such file or directory"?

vryzhko
Path Finder

After upgrading Splunk Enterprise from 6.3.3 to 6.4.0, I see this message:

[root@splunk bin]# $SPLUNK_HOME/bin/splunk start --accept-license --answer-yes

This appears to be an upgrade of Splunk.
--------------------------------------------------------------------------------)

Splunk has detected an older version of Splunk installed on this machine. To
finish upgrading to the new version, Splunk's installer will automatically
update and alter your current configuration files. Deprecated configuration
files will be renamed with a .deprecated extension.

You can choose to preview the changes that will be made to your configuration
files before proceeding with the migration and upgrade:

If you want to migrate and upgrade without previewing the changes that will be
made to your existing configuration files, choose 'y'.
If you want to see what changes will be made before you proceed with the
upgrade, choose 'n'.


Perform migration and upgrade without previewing configuration changes? [y/n] y

-- Migration information is being logged to '/opt/splunk/var/log/splunk/migration.log.2016-04-07.10-40-46' --

Migrating to:
VERSION=6.4.0
BUILD=f2c836328108
PRODUCT=splunk
PLATFORM=Linux-x86_64

Can't create directory "": No such file or directory


An error occurred: Could not create audit keys (returned 4).
[root@splunk bin]#

As a result Splunk does not start.
Please help me to resolve this issue!
Maybe you have ideas which directions to look.

Thank You!

Labels (1)
0 Karma
1 Solution

sgolyak
Engager

Same error happened.
I was able to overcome this by creating file /opt/splunk/etc/system/local/audit.conf with the following content:

[auditTrail]
privateKey = /opt/splunk/etc/auth/audit/private.pem
publicKey = /opt/splunk/etc/auth/audit/public.pem

View solution in original post

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...