Installation

After upgrading Splunk, why am I getting error "Cannot find any source of hashes. Manifest file '(null)' not present"?

jcrabb_splunk
Splunk Employee
Splunk Employee

After upgrading Splunk, I see the following error (in bold) when Splunk is started:


Checking prerequisites...

Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _internal _introspection _thefishbucket windows wineventlog winevents
Done

New certs have been generated in '/opt/splunk/etc/auth'.
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Cannot find any source of hashes. Manifest file '(null)' not present?
Problems were found, please review your files and move customizations to local
All preliminary checks passed.

Starting splunk server daemon (splunkd)...


What is the source of this error and how can it be corrected?

Jacob
Sr. Technical Support Engineer
Labels (1)
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

This can happen if during the upgrade process, the existing manifest file was not replaced by the new one for the version you are now on. You will want to be sure that the version of splunk that you are running and is listed in $SPLUNK_HOME/etc/splunk.version corresponds with the manifest file in $SPLUNK_HOME. For example:


[$SPLUNK_HOME/etc]# cat splunk.version

VERSION=6.3.1
BUILD=f3e41e4b37b2
PRODUCT=splunk
PLATFORM=Linux-x86_64



[$SPLUNK_HOME]#ls -al | grep splunk

-rw-r--r--. 1 root root 1737038 Dec 1 14:22 splunk-6.3.0-aa7d4b1ccb80-linux-2.6-x86_64-manifest


As you can see, the Splunk manifest file is for Splunk 6.3.0 but the version of Splunk on this system is 6.3.1. You will want to replace the manifest file with the correct one by copying it from the downloaded Splunk installation file.

Jacob
Sr. Technical Support Engineer

View solution in original post

jcrabb_splunk
Splunk Employee
Splunk Employee

This can happen if during the upgrade process, the existing manifest file was not replaced by the new one for the version you are now on. You will want to be sure that the version of splunk that you are running and is listed in $SPLUNK_HOME/etc/splunk.version corresponds with the manifest file in $SPLUNK_HOME. For example:


[$SPLUNK_HOME/etc]# cat splunk.version

VERSION=6.3.1
BUILD=f3e41e4b37b2
PRODUCT=splunk
PLATFORM=Linux-x86_64



[$SPLUNK_HOME]#ls -al | grep splunk

-rw-r--r--. 1 root root 1737038 Dec 1 14:22 splunk-6.3.0-aa7d4b1ccb80-linux-2.6-x86_64-manifest


As you can see, the Splunk manifest file is for Splunk 6.3.0 but the version of Splunk on this system is 6.3.1. You will want to replace the manifest file with the correct one by copying it from the downloaded Splunk installation file.

Jacob
Sr. Technical Support Engineer
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...