Knowledge Management

Splunk Platform Readiness App - Error reading progress for user.

SRHunter
Loves-to-Learn

In the process of upgrading our splunk enterprise. Currently on version 7.1.3 (I know, super old, bear with me). Installed the Splunk Platform Readiness App v.2.2.1, set the permissions to write as the documentation states. Go to launch the app and I get this error: 

Error reading progress for user: <me> on host <hostname>

 

Dig a bit more into it and realize that the Splunk Platform Readiness App uses the KV store. Run into these errors:

KV Store process terminated abnormally (exit code 14, status exited with code 14) See mongod.log and splunkd.log for details

KV Store changed status to failed. KV Store process terminated.

Failed to start KV Store process. See mongod.log and splunkd.log for details.

*******Splunk is running on Windows Server*******

I tried renaming the server.pem file in Splunk/etc/auth and restarting - it made a new server.pem file, same issues persist.

Attempted to look into the mongod.log and splunkd.log but I'm not sure what I should be looking for. 

Haven't yet tried to rename the mongo folder in /vat/lib/splunk/kvstore to mongo(old), as I saw that it worked for some other people with the same issue.

 

 

Did some more troubleshooting:

renamed the mongo folder to mongo(old) and it recreated a new one. Same issues as before.

Looked in the mongod.log file and found this:

Detected unclean shutdown - C:\Program Files\Splunk\var\lib\kvstore\mongo\mongod.lock is not empty.

InFile::open(), CreateFileW for C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\journal\lsn failed with Access is denied.

Labels (1)
0 Karma

PaulPanther
Motivator

Have you tried to stop Splunk, removing the mongod.lock file and then start Splunk again?

0 Karma

SRHunter
Loves-to-Learn

Yup, tried that, no joy. Same errors and the mongod.lock file just recreates itself.

0 Karma

PaulPanther
Motivator

On which splunk instance type do you face this issue?

As a last option you could clean up the whole kvstore...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...