Splunk Enterprise Security

Error migrating deprecated review status transitions

bestSplunker
Contributor

hi ,everyone!

Recently my splunk always received the following error message.I suspect it is a problem for splunk ES, I cant not find more information to determine what caused this error, I didn't search for similar issues on answer, so have anyone encountered the same problem? How to solve this problem?

pid=61165 tid=Main file=configuration_check.py:run:228|status="completesd" task="confcheck_es_migrate_reviewstatus_trasitions" message="Error migrating deprecated review status transitions"

jrballesteros05
Communicator

Hello.

Go to Settings -> Access Control -> Roles. You got to make sure you don't have any special character in the names. In my case I used to have a "Ñ". I changed the name and I solved the problem.

I hope it helps.

0 Karma

jrballesteros05
Communicator

Hello, have you solved this? I found an ES in the same situation and I don't know what to do.

0 Karma

jrballesteros05
Communicator

In "Configure->Configuration Checker -> confcheck_es_migrate_reviewstatus_trasitions" you can set in DEBUG mode. I am going to wait until I get a new warning.

0 Karma

jrballesteros05
Communicator

After set up in DEBUG mode I got this error:

2019-09-10 09:10:47,400+0000 ERROR pid=1382 tid=MainThread file=confcheck_es_migrate_reviewstatus_transitions.py:run:201 | () {'sessionKey': u'wEm^h1QMMujbz3PLPZUT93GAxUZT7TXSv7stcoP7xG5oSO9Vbk_^32Foo4s6^SnI8IAA9P1Vh4vPCpTmHw^uEKnmYVD7tBmkz6A8OzcEX6LEiOSyFuNCpwtauN', 'checkpoint_dir': u'/opt/splunk/var/lib/splunk/modinputs/configuration_check', 'namespace': 'SplunkEnterpriseSecuritySuite', 'data': {u'last_run': 1568041761.104844}}
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 177, in run
    role_transitions = getTransitionsToMigrate(sessionKey)
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 56, in wrapper
    raise TransitionsMigrationException(e, level, message)
TransitionsMigrationException
0 Karma

jrballesteros05
Communicator

I have found a problem with strange characters in rol names. I have a "ñ" into rol name and I think that's the problem. I'm going to change and I will tell you.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...