Hi dddillic,
We had that happened when doing a Splunk upgrade from 6.4.3 to 6.5.0 on SBOX 1.4 - which was confirmed as a SBOX bug....
Hope this helps ...
cheers, MuS
I looked at the manifest file for the 6.5.1 update (in $SPLUNK_HOME) and it appears that it updates the README file in etc/system/local
Hi dddillic,
We had that happened when doing a Splunk upgrade from 6.4.3 to 6.5.0 on SBOX 1.4 - which was confirmed as a SBOX bug....
Hope this helps ...
cheers, MuS
Interesting - thank you. Can you please convert it to an answer so I can accept it?
update ping ...
very kind - thank you.
@ddrillic
I see above that you are mentioning the indexes.conf file.
Are you using SBOX like @MuS and think this is a bug?
@sjohnson did not mention a change to indexes.conf in the inspection of the manifest below?
We don't use SBOX.
From which version you upgraded to 6.5.1?
We upgraded from 6.4.1.
There were changes in indexes.conf specification from 6.4.3 to 6.5.1 and Splunk would've validated/updated the indexes.conf file during upgrade process. Check the migration log ($Splunk_Home/var/log/splunk/migration_timestmap.log) and search for indexes.conf.
great. I see in the log the following -
Copying '/opt/splunk/etc/system/local/indexes.conf' to '/opt/splunk/etc/system/local/indexes.conf.old'
but nothing about modifying the file....
-rw-r--r--. 1 splnkstg dce 314 Jan 4 19:23 indexes.conf.old
-rw-r--r--. 1 splnkstg splnkstg 313 Jan 4 19:23 indexes.conf
One byte less in the modified file.
$ diff indexes.conf.old indexes.conf
2d1
<
4d2
< maxTotalDataSizeMB = 500000
5a4
> maxTotalDataSizeMB = 500000
8d6
< maxTotalDataSizeMB = 500000
9a8
> maxTotalDataSizeMB = 500000
12d10
< maxTotalDataSizeMB = 500000
13a12
> maxTotalDataSizeMB = 500000
16d14
< maxTotalDataSizeMB = 500000
17a16
> maxTotalDataSizeMB = 500000
I believe there was nothing changed on data perspective, may be some leading/trailing spaces got truncated. So basically you didn't have any incompatible indexes.conf entries so nothing new got updated, seems like it just created a backup and validated the stanzas as per 6.5.1 specification.
Makes perfect sense!!!