After upgrading to version 4.2 my Splunk server is not updating data.

[dannux]

I have upgraded one of my Splunk servers from version 4.1.7-95063 to version 4.2-96430. The server has stopped collecting data since.

I mainly have a several scripts that run from /prod/products/splunk/etc/bundles

the scripts are configured using inputs.conf props.conf

It looks to me that the files inputs.conf props.conf are not being used by Splunk 4.2 to collect data. When I wen into Maganger --> Data Input --> Script I do not see any of my 300+ scripts.

Is there a way I can get this working? This is the first time I am experiencing this kind of issue. I usually keep up to date with the latest Splunk version.

Thanks, Dan

[dannux]

Thank you for your answer. I tried that but after restarting Splunk I still not see any data coming. If I perform a search I cannot get any data after the upgrade. I have 300+ scripts running every minute. Any ideas?

[gkanapathy]

Using the bundles directory had been deprecated since at least version 4.0 (possibly 3.4 or earlier), though it did continue to work through 4.1. As of 4.2, you should use etc/apps/<appname>/local instead of etc/bundles/local. If you're not prepared to work with apps, you can simply copy the contents of etc/bundles to etc/apps/bundles.