Splunk Enterprise Security

Error migrating deprecated review status transitions

bestSplunker
Contributor

hi ,everyone!

Recently my splunk always received the following error message.I suspect it is a problem for splunk ES, I cant not find more information to determine what caused this error, I didn't search for similar issues on answer, so have anyone encountered the same problem? How to solve this problem?

pid=61165 tid=Main file=configuration_check.py:run:228|status="completesd" task="confcheck_es_migrate_reviewstatus_trasitions" message="Error migrating deprecated review status transitions"

jrballesteros05
Communicator

Hello.

Go to Settings -> Access Control -> Roles. You got to make sure you don't have any special character in the names. In my case I used to have a "Ñ". I changed the name and I solved the problem.

I hope it helps.

0 Karma

jrballesteros05
Communicator

Hello, have you solved this? I found an ES in the same situation and I don't know what to do.

0 Karma

jrballesteros05
Communicator

In "Configure->Configuration Checker -> confcheck_es_migrate_reviewstatus_trasitions" you can set in DEBUG mode. I am going to wait until I get a new warning.

0 Karma

jrballesteros05
Communicator

After set up in DEBUG mode I got this error:

2019-09-10 09:10:47,400+0000 ERROR pid=1382 tid=MainThread file=confcheck_es_migrate_reviewstatus_transitions.py:run:201 | () {'sessionKey': u'wEm^h1QMMujbz3PLPZUT93GAxUZT7TXSv7stcoP7xG5oSO9Vbk_^32Foo4s6^SnI8IAA9P1Vh4vPCpTmHw^uEKnmYVD7tBmkz6A8OzcEX6LEiOSyFuNCpwtauN', 'checkpoint_dir': u'/opt/splunk/var/lib/splunk/modinputs/configuration_check', 'namespace': 'SplunkEnterpriseSecuritySuite', 'data': {u'last_run': 1568041761.104844}}
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 177, in run
    role_transitions = getTransitionsToMigrate(sessionKey)
  File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/configuration_checks/confcheck_es_migrate_reviewstatus_transitions.py", line 56, in wrapper
    raise TransitionsMigrationException(e, level, message)
TransitionsMigrationException
0 Karma

jrballesteros05
Communicator

I have found a problem with strange characters in rol names. I have a "ñ" into rol name and I think that's the problem. I'm going to change and I will tell you.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...