In the process of upgrading our splunk enterprise. Currently on version 7.1.3 (I know, super old, bear with me). Installed the Splunk Platform Readiness App v.2.2.1, set the permissions to write as the documentation states. Go to launch the app and I get this error:
Error reading progress for user: <me> on host <hostname>
Dig a bit more into it and realize that the Splunk Platform Readiness App uses the KV store. Run into these errors:
KV Store process terminated abnormally (exit code 14, status exited with code 14) See mongod.log and splunkd.log for details
KV Store changed status to failed. KV Store process terminated.
Failed to start KV Store process. See mongod.log and splunkd.log for details.
*******Splunk is running on Windows Server*******
I tried renaming the server.pem file in Splunk/etc/auth and restarting - it made a new server.pem file, same issues persist.
Attempted to look into the mongod.log and splunkd.log but I'm not sure what I should be looking for.
Haven't yet tried to rename the mongo folder in /vat/lib/splunk/kvstore to mongo(old), as I saw that it worked for some other people with the same issue.
Did some more troubleshooting:
renamed the mongo folder to mongo(old) and it recreated a new one. Same issues as before.
Looked in the mongod.log file and found this:
Detected unclean shutdown - C:\Program Files\Splunk\var\lib\kvstore\mongo\mongod.lock is not empty.
InFile::open(), CreateFileW for C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\journal\lsn failed with Access is denied.
Have you tried to stop Splunk, removing the mongod.lock file and then start Splunk again?
Yup, tried that, no joy. Same errors and the mongod.lock file just recreates itself.
On which splunk instance type do you face this issue?
As a last option you could clean up the whole kvstore...