Join the Conversation
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Invalid message type: 28 during Splunk ES 7.1 Upgr...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting this error via UI upgrade to Splunk 7.1: Invalid message type: 28
We're on version 9.0.4. Previous upgrade work without this error using the UI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We deleted the /tmp to clear for the upgrade after failure. Did the CLI upgrade instead based on the documentation.
Upgrade Splunk Enterprise Security - Splunk Documentation
./splunk install app <path to app> -update 1 -auth <username>:<password>Then we went the UI portion to finish the configuration. Watch the usual logs. Restarted the web UI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We deleted the /tmp to clear for the upgrade after failure. Did the CLI upgrade instead based on the documentation.
Upgrade Splunk Enterprise Security - Splunk Documentation
./splunk install app <path to app> -update 1 -auth <username>:<password>Then we went the UI portion to finish the configuration. Watch the usual logs. Restarted the web UI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just noticed the same type-28 error. Before this occurred, were getting a "500 Internal Server" error. We are on Splunk 9.0.5
Waiting to hear back from Splunk support if they can resolve the UI install issue with ES 7.1.1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It appears the problem still around. I am upgrading to 7.3.1 and still getting the error. I had to use the CLI option to upgrade.
Your Guide to Splunk Digital Experience Monitoring
Data Management Digest – November 2025
Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA
