Splunk Enterprise Security

Error migrating deprecated review status transitions

bestSplunker
Contributor

hi ,everyone!

Recently my splunk always received the following error message.I suspect it is a problem for splunk ES, I cant not find more information to determine what caused this error, I didn't search for similar issues on answer, so have anyone encountered the same problem? How to solve this problem?

pid=61165 tid=Main file=configuration_check.py:run:228|status="completesd" task="confcheck_es_migrate_reviewstatus_trasitions" message="Error migrating deprecated review status transitions"

jrballesteros05
Communicator

Hello.

Go to Settings -> Access Control -> Roles. You got to make sure you don't have any special character in the names. In my case I used to have a "Ñ". I changed the name and I solved the problem.

I hope it helps.

0 Karma

jrballesteros05
Communicator

Hello, have you solved this? I found an ES in the same situation and I don't know what to do.

0 Karma

jrballesteros05
Communicator

In "Configure->Configuration Checker -> confcheck_es_migrate_reviewstatus_trasitions" you can set in DEBUG mode. I am going to wait until I get a new warning.

0 Karma

jrballesteros05
Communicator

After set up in DEBUG mode I got this error:

2019-09-10 09:10:47,400+0000 ERROR pid=1382 tid=MainThread file=confcheck_es_migrate_reviewstatus_transitions.py:run:201 | () {'sessionKey': u'wEm^h1QMMujbz3PLPZUT93GAxUZT7TXSv7stcoP7xG5oSO9Vbk_^32Foo4s6^SnI8IAA9P1Vh4vPCpTmHw^uEKnmYVD7tBmkz6A8OzcEX6LEiOSyFuNCpwtauN', 'checkpoint_dir': u'/opt/splunk/var/lib/splunk/modinputs/configuration_check', 'namespace': 'SplunkEnterpriseSecuritySuite', 'data': {u'last_run': 1568041761.104844}}
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 177, in run
    role_transitions = getTransitionsToMigrate(sessionKey)
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 56, in wrapper
    raise TransitionsMigrationException(e, level, message)
TransitionsMigrationException
0 Karma

jrballesteros05
Communicator

I have found a problem with strange characters in rol names. I have a "ñ" into rol name and I think that's the problem. I'm going to change and I will tell you.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...