Knowledge Management

Splunk Platform Readiness App - Error reading progress for user.

SRHunter
Explorer

In the process of upgrading our splunk enterprise. Currently on version 7.1.3 (I know, super old, bear with me). Installed the Splunk Platform Readiness App v.2.2.1, set the permissions to write as the documentation states. Go to launch the app and I get this error: 

Error reading progress for user: <me> on host <hostname>

 

Dig a bit more into it and realize that the Splunk Platform Readiness App uses the KV store. Run into these errors:

KV Store process terminated abnormally (exit code 14, status exited with code 14) See mongod.log and splunkd.log for details

KV Store changed status to failed. KV Store process terminated.

Failed to start KV Store process. See mongod.log and splunkd.log for details.

*******Splunk is running on Windows Server*******

I tried renaming the server.pem file in Splunk/etc/auth and restarting - it made a new server.pem file, same issues persist.

Attempted to look into the mongod.log and splunkd.log but I'm not sure what I should be looking for. 

Haven't yet tried to rename the mongo folder in /vat/lib/splunk/kvstore to mongo(old), as I saw that it worked for some other people with the same issue.

 

 

Did some more troubleshooting:

renamed the mongo folder to mongo(old) and it recreated a new one. Same issues as before.

Looked in the mongod.log file and found this:

Detected unclean shutdown - C:\Program Files\Splunk\var\lib\kvstore\mongo\mongod.lock is not empty.

InFile::open(), CreateFileW for C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\journal\lsn failed with Access is denied.

Labels (1)
0 Karma
1 Solution

SRHunter
Explorer

I'm dumb, turns out that none of the apps I have installed are even using the KV Store after messaging Splunk support.

View solution in original post

0 Karma

SRHunter
Explorer

I'm dumb, turns out that none of the apps I have installed are even using the KV Store after messaging Splunk support.

0 Karma

PaulPanther
Motivator

Have you tried to stop Splunk, removing the mongod.lock file and then start Splunk again?

0 Karma

SRHunter
Explorer

Yup, tried that, no joy. Same errors and the mongod.lock file just recreates itself.

0 Karma

PaulPanther
Motivator

On which splunk instance type do you face this issue?

As a last option you could clean up the whole kvstore...

0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...