After upgrading Splunk, why am I getting error "Cannot find any source of hashes. Manifest file '(null)' not present"?

[jcrabb_splunk]

After upgrading Splunk, I see the following error (in bold) when Splunk is started:

---

Checking prerequisites...

Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _internal _introspection _thefishbucket windows wineventlog winevents
Done

New certs have been generated in '/opt/splunk/etc/auth'.
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Cannot find any source of hashes. Manifest file '(null)' not present?
Problems were found, please review your files and move customizations to local
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

---

What is the source of this error and how can it be corrected?

[jcrabb_splunk · Accepted solution]

This can happen if during the upgrade process, the existing manifest file was not replaced by the new one for the version you are now on. You will want to be sure that the version of splunk that you are running and is listed in $SPLUNK_HOME/etc/splunk.version corresponds with the manifest file in $SPLUNK_HOME. For example:

---

[$SPLUNK_HOME/etc]# cat splunk.version

VERSION=6.3.1
BUILD=f3e41e4b37b2
PRODUCT=splunk
PLATFORM=Linux-x86_64

---

---

[$SPLUNK_HOME]#ls -al | grep splunk

-rw-r--r--. 1 root root 1737038 Dec 1 14:22 splunk-6.3.0-aa7d4b1ccb80-linux-2.6-x86_64-manifest

---

As you can see, the Splunk manifest file is for Splunk 6.3.0 but the version of Splunk on this system is 6.3.1. You will want to replace the manifest file with the correct one by copying it from the downloaded Splunk installation file.