Knowledge Management

Post upgrade of 3 Node Search Head Cluster from vesrion 8.2.7 ,one SHC Kvstore status as DOWN

Splunk Employee
Splunk Employee

The env was on 8.2.7.
 the environment has 3 Node Search Head Cluster.
Nodes upgraded from version 8.2.7 to  9.0.2.
Post upgrade for one  SHC member the kvstore status was  DOWN.



Labels (1)
0 Karma

Splunk Employee
Splunk Employee

The mongod.log, it is failed to recover because of OplogStartMissing, which is a known issue



2022-11-29T05:01:57.080Z I REPL [rsBackgroundSync] Starting rollback due to OplogStartMissing: Our last op time fetched: { ts: Timestamp(1669697961, 2), t: 79 }. source's GTE: { ts: Timestamp(1669698089, 2), t: 80 } hashes: (6527934590833943207/-6009016642415496648)

2022-11-29T05:01:57.102Z F ROLLBACK [rsBackgroundSync] RecoverToStableTimestamp failed. :: caused by :: UnrecoverableRollbackError: No stable timestamp available to recover to. You must downgrade the binary version to v3.6 to allow rollback to finish. You may upgrade to v4.0 again after the rollback completes. Initial data timestamp: Timestamp(1669697961, 2), Stable timestamp: Timestamp(0, 0)


To resolve the issue

# splunk stop
# splunk clean kvstore --local
# splunk start

Once the KVStore is up, it was on 4.0 . Manually upgraded kvstore to  4.2 as per "Upgrade KV store server to version 4.2" and documentation


0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...