Splunk Enterprise Security

After upgrading Splunk Enterprise Security 3.3.0 to 4.0 for Splunk 6.3.1 on Windows 2012, why are we getting "...KV Store initialization has failed'?

belka
Path Finder

We were upgrading Splunk Enterprise Security 3.3.0 to ES 4.0 on Windows 2012 running Splunk 6.3.1. We ran into errors with Splunk ES 4.0 hanging up during the configuration phase. We did the manual work around contained in the article here: https://answers.splunk.com/answers/323361/upgrade-enterprise-security-from-33x-to-40-hangs-o.html

We got ES 4.0 to come up. The manual process allowed us to skip the ES 4.0 APPs that returned the "JSON not serializable" errors. Now that ES 4.0 is up and running, we are getting multiple errors of this sort: "External command based lookup 'es_notable_events' is not available because KV Store initialization has failed. "

We are trying to troubleshoot how we can over come this error by correcting what ever missing or altered configuration is causing this error.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Check this previous answer: https://answers.splunk.com/answers/215816/after-upgrading-splunk-app-for-microsoft-exchange.html. It might be that you need to restart the mongod process manually, or that there is a permissions issue on a file somewhere.

0 Karma

belka
Path Finder

I found that reference. We are working through it and trying to see if that will solve the issue.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...