Splunk Enterprise Security

Error migrating deprecated review status transitions

bestSplunker
Contributor

hi ,everyone!

Recently my splunk always received the following error message.I suspect it is a problem for splunk ES, I cant not find more information to determine what caused this error, I didn't search for similar issues on answer, so have anyone encountered the same problem? How to solve this problem?

pid=61165 tid=Main file=configuration_check.py:run:228|status="completesd" task="confcheck_es_migrate_reviewstatus_trasitions" message="Error migrating deprecated review status transitions"

jrballesteros05
Communicator

Hello.

Go to Settings -> Access Control -> Roles. You got to make sure you don't have any special character in the names. In my case I used to have a "Ñ". I changed the name and I solved the problem.

I hope it helps.

0 Karma

jrballesteros05
Communicator

Hello, have you solved this? I found an ES in the same situation and I don't know what to do.

0 Karma

jrballesteros05
Communicator

In "Configure->Configuration Checker -> confcheck_es_migrate_reviewstatus_trasitions" you can set in DEBUG mode. I am going to wait until I get a new warning.

0 Karma

jrballesteros05
Communicator

After set up in DEBUG mode I got this error:

2019-09-10 09:10:47,400+0000 ERROR pid=1382 tid=MainThread file=confcheck_es_migrate_reviewstatus_transitions.py:run:201 | () {'sessionKey': u'wEm^h1QMMujbz3PLPZUT93GAxUZT7TXSv7stcoP7xG5oSO9Vbk_^32Foo4s6^SnI8IAA9P1Vh4vPCpTmHw^uEKnmYVD7tBmkz6A8OzcEX6LEiOSyFuNCpwtauN', 'checkpoint_dir': u'/opt/splunk/var/lib/splunk/modinputs/configuration_check', 'namespace': 'SplunkEnterpriseSecuritySuite', 'data': {u'last_run': 1568041761.104844}}
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 177, in run
    role_transitions = getTransitionsToMigrate(sessionKey)
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 56, in wrapper
    raise TransitionsMigrationException(e, level, message)
TransitionsMigrationException
0 Karma

jrballesteros05
Communicator

I have found a problem with strange characters in rol names. I have a "ñ" into rol name and I think that's the problem. I'm going to change and I will tell you.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...