- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the process of upgrading our splunk enterprise. Currently on version 7.1.3 (I know, super old, bear with me). Installed the Splunk Platform Readiness App v.2.2.1, set the permissions to write as the documentation states. Go to launch the app and I get this error:
Error reading progress for user: <me> on host <hostname>
Dig a bit more into it and realize that the Splunk Platform Readiness App uses the KV store. Run into these errors:
KV Store process terminated abnormally (exit code 14, status exited with code 14) See mongod.log and splunkd.log for details
KV Store changed status to failed. KV Store process terminated.
Failed to start KV Store process. See mongod.log and splunkd.log for details.
*******Splunk is running on Windows Server*******
I tried renaming the server.pem file in Splunk/etc/auth and restarting - it made a new server.pem file, same issues persist.
Attempted to look into the mongod.log and splunkd.log but I'm not sure what I should be looking for.
Haven't yet tried to rename the mongo folder in /vat/lib/splunk/kvstore to mongo(old), as I saw that it worked for some other people with the same issue.
Did some more troubleshooting:
renamed the mongo folder to mongo(old) and it recreated a new one. Same issues as before.
Looked in the mongod.log file and found this:
Detected unclean shutdown - C:\Program Files\Splunk\var\lib\kvstore\mongo\mongod.lock is not empty.
InFile::open(), CreateFileW for C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\journal\lsn failed with Access is denied.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm dumb, turns out that none of the apps I have installed are even using the KV Store after messaging Splunk support.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm dumb, turns out that none of the apps I have installed are even using the KV Store after messaging Splunk support.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried to stop Splunk, removing the mongod.lock file and then start Splunk again?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yup, tried that, no joy. Same errors and the mongod.lock file just recreates itself.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On which splunk instance type do you face this issue?
As a last option you could clean up the whole kvstore...
