internal server error 500 because of index _actions, during upgrade 3.* to 4.*

[mataharry]

Hi, I am a bit impressed, this is my first post.

I wanted to upgrade from a splunk 3.4 to 4.1.5 but once done, the browser do an error 500. and say : InternalServerError HTTP500 In handler 'indexes' Parameters beginning with '_' are reserved for EAI's Usage will not allow '_actions'

What is that ? I never created an index starting with underscore.

[yannK · Accepted solution]

Hi Mata

It seems that you encountered the deprecated "_actions" index from the old index_server app.

A quick way to fix it is to comment the line starting with : _actions in $SPLUNK_HOME/etc/apps/index_server/default/indexes.conf

If you can't find the line in this specific configuration file, you can use the following command to find it : find $SPLUNK_HOME/etc -name indexes.conf | xargs grep ^_action

then restart splunk.