If you are seeing this message in $SPLUNK_HOME/var/log/splunkd.log -
04-05-2010 13:45:21.177 ERROR FTHelper - IndexProcessor instance is null, assuming 3.X fish bucket exists, will lazy migrate
And the following error in the search app when you log in to Splunk
There is no query runner registered
This is likely because the migration script from an earlier version of Splunk did not complete correctly. To resolve, you need to get the correct version of $SPLUNK_HOME/etc/myinstall/splunkd.xml in place and restart Splunk. if you download a tarball package of Splunk, and extract $SPLUNK_HOME/etc/myinstall/splunkd.xml.cfg-default - that's the file you need.
Installation instructions -
- stop splunk
- cd /opt/splunk/etc/myinstall/
- mv splunkd.xml splunkd.xml.4x
- download the extracted file into /opt/splunk/etc/myinstall
- gunzip splunkd.xml.gz
- verify permissions and ownership of splunkd.xml (match splunkd.xml.4x)
- start splunk
If you also take a look in $SPLUNK_HOME/var/log/splunk/migration.log, you'll see confirmation of the migration error
