Splunk Enterprise Security

After upgrading Splunk Enterprise Security 3.3.0 to 4.0 for Splunk 6.3.1 on Windows 2012, why are we getting "...KV Store initialization has failed'?

belka
Path Finder

We were upgrading Splunk Enterprise Security 3.3.0 to ES 4.0 on Windows 2012 running Splunk 6.3.1. We ran into errors with Splunk ES 4.0 hanging up during the configuration phase. We did the manual work around contained in the article here: https://answers.splunk.com/answers/323361/upgrade-enterprise-security-from-33x-to-40-hangs-o.html

We got ES 4.0 to come up. The manual process allowed us to skip the ES 4.0 APPs that returned the "JSON not serializable" errors. Now that ES 4.0 is up and running, we are getting multiple errors of this sort: "External command based lookup 'es_notable_events' is not available because KV Store initialization has failed. "

We are trying to troubleshoot how we can over come this error by correcting what ever missing or altered configuration is causing this error.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Check this previous answer: https://answers.splunk.com/answers/215816/after-upgrading-splunk-app-for-microsoft-exchange.html. It might be that you need to restart the mongod process manually, or that there is a permissions issue on a file somewhere.

0 Karma

belka
Path Finder

I found that reference. We are working through it and trying to see if that will solve the issue.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...