Upgraded to 4.3.3 (from 4.2.2). Lost Saved Search owners

[Sqig]

Hi. We just upgraded from 4.2.2 to 4.3.3.

We are using search head pooling, so we followed the specific instructions for dealing with that situation (ie, unpool, upgrade each head, repool).

Now, it seems that Views and Saved Searches by some of our users are showing up as having no owner.

I checked and it looks to me like the user's directory exists in $SHARED/etc/users and (as you might expect) not in $SPLUNK_HOME/etc/users

Has anyone else run into this? I did make a backup of everything before the upgrade, so if the upgrade clobbered some critical files I'm not aware of, I could replace them, I just don't even know where to start!

[rmorlen · Accepted solution]

We run Splunk pooled. Typically for an upgrade I do the following:

Stop Splunk

Unpool

Backup the pooled etc/users and etc/apps

Copy etc/users to local $SPLUNK_HOME/etc/users

Copy etc/apps to local $SPLUNK_HOME/etc/apps

Upgrade Splunk

Start Splunk

Stop Splunk

Copy $SPLUNK_HOME/etc/users back the pooled location

Copy $SPLUNK_HOME/etc/apps back to the pooled location

Enable Pooling

Start Splunk

I only do the copy (both directions) for one server since it is pooled.

[Sqig]

Thanks. I thought to copy pooled/etc/apps back pre-upgrade but not pooled/etc/users. Looks like i have to roll back on one server and re-upgrade in order for all the apps to see their rightful owners.