Installation

Getting "Invalid Site Id" error after Splunk upgrade from 5.0.2 to 6.1.1.

Explorer

Just upgraded a search head to 6.1.1 from 5.0.2. (Indexers on separate system and is at 6.1.1).
One of my users is reporting the following errors using the REST API:

[ovm5] Search results may be incomplete, peer ms28.foo.com's
search ended prematurely. Error = Invalid site id:
[ovm6] Search results may be incomplete, peer ms28.foo.com's
search ended prematurely. Error = Invalid site id:

The same search was working prior to the upgrade. Does anyone know what is causing this and, if so, any pointers to a solution would be appreciated.

TB

Labels (3)
0 Karma

Splunk Employee
Splunk Employee

Hey TB,

Your SH and indexers should be on the same version, else you will get this error. I had the same message, but when I upgraded them all to the same version, things went smoothly.

I was told by Splunk ENG that minor subversions are ok i.e. 6.0.1 --> 6.0.3 but not minor versions i.e. 6.0 --> 6.1

Good luck!

Kyle

0 Karma

Community Manager
Community Manager

Hi @khourihan_splunk

I think @toddbruner's SH and indexer are currently the same version?

"Just upgraded a search head to 6.1.1 from 5.0.2. (Indexers on separate system and is at 6.1.1)"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!