Update to Splunk 4.3.3 failing

[balbano]

Hello,

I tried upgrading my Splunk Indexers to 4.3.2 to 4.3.3 but its failing for some reason.

[root@server ~]# uname -a
Linux server 2.6.18-238.12.1.el5 #1 SMP Sat May 7 20:18:50 EDT 2011 x86_64 x86_64 x86_64  GNU/Linux

[root@server ~]# rpm -qa | grep splunk
splunk-4.3.2-123586

[root@server ~]# rpm -Uvh splunk-4.3.3-128297-linux-2.6-x86_64.rpm
warning: splunk-4.3.3-128297-linux-2.6-x86_64.rpm: Header V3 DSA signature: NOKEY, key ID 653fb112
Preparing...                ########################################### [100%]
This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed     
Splunk Server...
 [  OK  ]
Stopping splunkweb...Stopping splunkd...
Shutting down.  Please wait, as this may take a few minutes.
............ [  OK  ]
Stopping splunk helpers...
 [  OK  ]
Done.
   1:splunk                 ########################################### [100%]
error: unpacking of archive failed on file /opt/splunk/bin/splunkd;4fecadc5: cpio: read

Any reason why this is happening?
Any one else having this issue?

Let me know.

Thanks.

Brian

[sowings · Accepted solution]

I wonder whether your copy of the RPM might be corrupted? My first attempt to download the package aborted for some reason, leaving me only a 4.1MB file when it should be 34197501 bytes (~33M). The MD5 sum for the file I downloaded is 7b941fdb996fe8be1023044bceab1d47.

If file corruption isn't it, could there be disk space issues on the target filesystem?

[balbano]

Yea definitely was file corrpution when I looked closer into it.

Thanks.
B