Splunk Enterprise Security

Enterprise Security app error while upgrading

udayk1
Path Finder

Received the error while upgrading the ESS app from 2.4 to 3.0.1. Below is the error,
"ERROR - step:upgrade|Filesize would require ZIP64 extensions"

We are using Splunk 6 and upgraded from 5.0.4 very recently.

Please help regarding ESS upgrade.

0 Karma

dshpritz
SplunkTrust
SplunkTrust

So, there was no answer posted on this, but here it is:

Most likely what is happening is that there is a very large file (most likely one of the generated lookups) in your ES install. Before performing an upgrade, ES makes a backup. It creates this backup using Python's zipfile module (I believe), which does not handle large zip files by default (see: https://docs.python.org/2/library/zipfile.html). When the back fails, because it gets too big, you get the error.

To solve, find the large file (again, usually a CSV), move it out of the apps directory, do the upgrade, move the file back to where you found it.

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, that's a new one on me -- I'd contact support.

0 Karma

udayk1
Path Finder

Can any one update on this?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...