Installation

Getting distributed search key error when trying to upgrade to Splunk 6.1.1.

carlitosway
New Member

Has anyone experienced this error? I'm using a single deployment not a distributed one.

Since the file was missing, I generated a generic distsearch.conf file and placed it under /opt/splunk/etc/system/local and still get the same error when I try and start splunk.

Migrating to:
VERSION=6.1.1
BUILD=207789
PRODUCT=splunk
PLATFORM=Linux-i386

********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********

Unable to generate distributed search keys.

An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may be corrupt or may require a restart.

Labels (2)
0 Karma

vkora
New Member

Following worked for me:

$ cp /opt/splunk/etc/system/default/distsearch.conf /opt/splunk/etc/system/local/distsearch.conf

$ chmod 640 /opt/splunk/etc/system/local/distsearch.conf
$ cd /opt/splunk/etc/auth/distServerKeys
$ mv private.pem private.pem_old
$ mv trusted.pem trusted.pem_old
$ splunk restart

0 Karma

carlitosway
New Member

I'm running this OS.
Linux hostname 3.2.0-4-686-pae #1 SMP Debian 3.2.57-3 i686 GNU/Linux

0 Karma

carlitosway
New Member

WoW quick update, backed up all the configurations, indexes and deleted everything. Installed it from scratch and still get this error.

This appears to be your first time running this version of Splunk.
.........
Generating RSA private key, 1024 bit long modulus
........++++++
..............................................++++++
e is 65537 (0x10001)
writing RSA key

Unable to generate distributed search keys.

An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may require a restart.

0 Karma

carlitosway
New Member

Still have this problem, it did not go away with 6.1.2.

Migrating to:
VERSION=6.1.2
BUILD=213098
PRODUCT=splunk
PLATFORM=Linux-i386

Unable to generate distributed search keys.

An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may require a restart.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...