Installation
Highlighted

Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

Ultra Champion

We went through an upgrade to 6.5.1 and the upgrade touched SPLUNK_HOME/etc/system/local on the indexers. Should it happen? We see indexes.conf with a new timestamp.

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

SplunkTrust
SplunkTrust

From which version you upgraded to 6.5.1?

Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

Ultra Champion

We upgraded from 6.4.1.

0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

SplunkTrust
SplunkTrust

There were changes in indexes.conf specification from 6.4.3 to 6.5.1 and Splunk would've validated/updated the indexes.conf file during upgrade process. Check the migration log ($SplunkHome/var/log/splunk/migrationtimestmap.log) and search for indexes.conf.

0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

Ultra Champion

great. I see in the log the following -

Copying '/opt/splunk/etc/system/local/indexes.conf' to '/opt/splunk/etc/system/local/indexes.conf.old' but nothing about modifying the file....

-rw-r--r--. 1 splnkstg dce       314 Jan  4 19:23 indexes.conf.old
-rw-r--r--. 1 splnkstg splnkstg  313 Jan  4 19:23 indexes.conf

One byte less in the modified file.

$ diff indexes.conf.old indexes.conf
2d1
< 
4d2
< maxTotalDataSizeMB = 500000
5a4
> maxTotalDataSizeMB = 500000
8d6
< maxTotalDataSizeMB = 500000
9a8
> maxTotalDataSizeMB = 500000
12d10
< maxTotalDataSizeMB = 500000
13a12
> maxTotalDataSizeMB = 500000
16d14
< maxTotalDataSizeMB = 500000
17a16
> maxTotalDataSizeMB = 500000
0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

SplunkTrust
SplunkTrust

I believe there was nothing changed on data perspective, may be some leading/trailing spaces got truncated. So basically you didn't have any incompatible indexes.conf entries so nothing new got updated, seems like it just created a backup and validated the stanzas as per 6.5.1 specification.

0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

Ultra Champion

Makes perfect sense!!!

0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

SplunkTrust
SplunkTrust

Hi dddillic,

We had that happened when doing a Splunk upgrade from 6.4.3 to 6.5.0 on SBOX 1.4 - which was confirmed as a SBOX bug....

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

Ultra Champion

Interesting - thank you. Can you please convert it to an answer so I can accept it?

0 Karma
Highlighted

Re: Why does the upgrade to 6.5.1 touch SPLUNK_HOME/etc/system/local?

SplunkTrust
SplunkTrust

update ping ...

0 Karma