Getting distributed search key error when trying to upgrade to Splunk 6.1.1.

[carlitosway]

Has anyone experienced this error? I'm using a single deployment not a distributed one.

Since the file was missing, I generated a generic distsearch.conf file and placed it under /opt/splunk/etc/system/local and still get the same error when I try and start splunk.

Migrating to:
VERSION=6.1.1
BUILD=207789
PRODUCT=splunk
PLATFORM=Linux-i386

********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********

Unable to generate distributed search keys.

An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may be corrupt or may require a restart.

[vkora]

Following worked for me:

$ cp /opt/splunk/etc/system/default/distsearch.conf /opt/splunk/etc/system/local/distsearch.conf

$ chmod 640 /opt/splunk/etc/system/local/distsearch.conf
$ cd /opt/splunk/etc/auth/distServerKeys
$ mv private.pem private.pem_old
$ mv trusted.pem trusted.pem_old
$ splunk restart

[carlitosway]

I'm running this OS.
Linux hostname 3.2.0-4-686-pae #1 SMP Debian 3.2.57-3 i686 GNU/Linux

[carlitosway]

WoW quick update, backed up all the configurations, indexes and deleted everything. Installed it from scratch and still get this error.

This appears to be your first time running this version of Splunk.
.........
Generating RSA private key, 1024 bit long modulus
........++++++
..............................................++++++
e is 65537 (0x10001)
writing RSA key

Unable to generate distributed search keys.

An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may require a restart.

[carlitosway]

Still have this problem, it did not go away with 6.1.2.

Migrating to:
VERSION=6.1.2
BUILD=213098
PRODUCT=splunk
PLATFORM=Linux-i386

Unable to generate distributed search keys.

An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may require a restart.