Upgraded heavy forwarder from 6.1.2 to 6.4.2 and unable to access data inputs from web.

[cyndiback]

Upgraded heavy forwarder from 6.1.2 to 6.4.2 unable to access data inputs from web.

From Splunk forwarder webpage >> Settings >> Data Inputs >> I get 500 error below (I removed the dns name from the link).
This has happened on 4 of my forwarders same version upgrade

500 Internal Server Error

Return to Splunk home page

View more information about your request (request ID = 578791ed777f92503880d0) in Search 

This page was linked to from https://dns_name:8000/en-US/app/launcher/home. 

[woodcock]

Open a support case.

[abeeber_2]

I had this same problem going from 6.4.1 to 6.4.2. I could access all submenus from System except Data Inputs.

As soon as I clicked on Data Inputs, I would get an 500 Internal Error.

I rolled back to 6.4.1 and was able to access Data Inputs. I then upgraded to 6.4.2 again, and tried accessing the same menu again; and received the same 500 error.

I've since rolled back to 6.4.1 until I figure out what is going on with 6.4.2.

[cyndiback]

I've opened as support case and will let you know what they say.

[yuanliu]

How do I roll back? (I got the same error, on OS X 10.10.5)

[abeeber_2]

I would make a copy of your /Applications/Splunk folder for backup purposes and then re-install 6.4.1 on top of 6.4.2.

This will roll your installation back to 6.4.1. I just tested this is on my MAC and had no problems.

If things don't work then, I would completely remove Splunk. Re-install Splunk 6.4.1.

BEFORE starting it; I would copy your original /Applications/Splunk/etc and /Applications/Splunk/var folders back into your Splunk folder structure. I would then start Splunk. It should onboard your apps, indexes and any custom settings you've made. I've done this many times in Windows and Linux. Its a very simple and robust product due to the fact that its configurations based off of its configuration files.

The only time you need to be wary of upgrading and rolling back is when Splunk writes or modifies underlying indexes. When that happens there is no going back.

[yuanliu]

Thank you, @abeeber_2. I have deleted older Splunk installers. When I go back to Download -> Older Releases, I can only find 6.2.4. Do you have a link or navigation path?

[abeeber_2]

Yeah.. I noticed that too. If you scroll down, you'll find 6.4.1

[abeeber_2]

For some reason, 6.4.1 is listed below 5.0.2.

The older release list is not sorted correctly (at least for the MAC OSX branch).

[yuanliu]

Got it. That's quite a layout:-)

[neelamssantosh]

Have u got Any update from Support team.