Upgraded heavy forwarder from 6.1.2 to 6.4.2 unable to access data inputs from web.
From Splunk forwarder webpage >> Settings >> Data Inputs >> I get 500 error below (I removed the dns name from the link).
This has happened on 4 of my forwarders same version upgrade
500 Internal Server Error Return to Splunk home page View more information about your request (request ID = 578791ed777f92503880d0) in Search This page was linked to from https://dns_name:8000/en-US/app/launcher/home.
I had this same problem going from 6.4.1 to 6.4.2. I could access all submenus from System except Data Inputs.
As soon as I clicked on Data Inputs, I would get an 500 Internal Error.
I rolled back to 6.4.1 and was able to access Data Inputs. I then upgraded to 6.4.2 again, and tried accessing the same menu again; and received the same 500 error.
I've since rolled back to 6.4.1 until I figure out what is going on with 6.4.2.
I would make a copy of your /Applications/Splunk folder for backup purposes and then re-install 6.4.1 on top of 6.4.2.
This will roll your installation back to 6.4.1. I just tested this is on my MAC and had no problems.
If things don't work then, I would completely remove Splunk. Re-install Splunk 6.4.1.
BEFORE starting it; I would copy your original /Applications/Splunk/etc and /Applications/Splunk/var folders back into your Splunk folder structure. I would then start Splunk. It should onboard your apps, indexes and any custom settings you've made. I've done this many times in Windows and Linux. Its a very simple and robust product due to the fact that its configurations based off of its configuration files.
The only time you need to be wary of upgrading and rolling back is when Splunk writes or modifies underlying indexes. When that happens there is no going back.