Installation
Highlighted

internal server error 500 because of index _actions, during upgrade 3.* to 4.*

Communicator

Hi, I am a bit impressed, this is my first post.

I wanted to upgrade from a splunk 3.4 to 4.1.5 but once done, the browser do an error 500. and say : InternalServerError HTTP500 In handler 'indexes' Parameters beginning with '_' are reserved for EAI's Usage will not allow '_actions'

What is that ? I never created an index starting with underscore.

Tags (3)
Highlighted

Re: internal server error 500 because of index _actions, during upgrade 3.* to 4.*

Splunk Employee
Splunk Employee

Hi Mata

It seems that you encountered the deprecated "_actions" index from the old index_server app.

A quick way to fix it is to comment the line starting with : _actions in $SPLUNK_HOME/etc/apps/index_server/default/indexes.conf

If you can't find the line in this specific configuration file, you can use the following command to find it : find $SPLUNK_HOME/etc -name indexes.conf | xargs grep ^_action

then restart splunk.

View solution in original post