Index processor wont start after upgrading to 4.1

[Alan_Bradley]

I just upgraded from 4.0 to 4.1 and am seeing messages that the indexprocessor was not initialized on startup. How can I fix this?

[Mick · Accepted solution]

If you are seeing this message in $SPLUNK_HOME/var/log/splunkd.log -

04-05-2010 13:45:21.177 ERROR FTHelper - IndexProcessor instance is null, assuming 3.X fish bucket exists, will lazy migrate

And the following error in the search app when you log in to Splunk

There is no query runner registered

This is likely because the migration script from an earlier version of Splunk did not complete correctly. To resolve, you need to get the correct version of $SPLUNK_HOME/etc/myinstall/splunkd.xml in place and restart Splunk. if you download a tarball package of Splunk, and extract $SPLUNK_HOME/etc/myinstall/splunkd.xml.cfg-default - that's the file you need.

Installation instructions -

• stop splunk
• cd /opt/splunk/etc/myinstall/
• mv splunkd.xml splunkd.xml.4x
• download the extracted file into /opt/splunk/etc/myinstall
• gunzip splunkd.xml.gz
• verify permissions and ownership of splunkd.xml (match splunkd.xml.4x)
• start splunk

If you also take a look in $SPLUNK_HOME/var/log/splunk/migration.log, you'll see confirmation of the migration error