Problem after upgrade Splunk ES from version 5.1.0 to 5.2.2

[splunker2020]

Hello,

I have a problem after the upgrade of the application Splunk ES from version 5.1.0 to 5.2.2 on the Splunk Entreprise 7.2.0.

I get this error on the Splunk Web "Unable to initialize modular input "ess_content_importer" defined inside the app "SplunkEnterpriseSecuritySuite": Introspecting scheme=ess_content_importer: script running failed (exited with code 1)"

Any help please.

Best Regards,

[lkutch_splunk]

Is it a deployment server in a cluster or a single search head? Any extra clues in $SPLUNK_HOME/var/log/splunk/essinstaller2.log? Did you use the same OS user for installation of ES that you used during installing splunk? (I don't know the answer yet, just some questions I've seen to help narrow it down.)

[splunker2020]

Hi,

For the first quetion about the deployment of Splunk is a Single Instance Server.

The error logs on the file essinstaller2.log :

" File "C:\Program Files\Splunk\etc\apps\SplunkEnterpriseSecuritySuite\bin\essinstall.py", line 161, in do_install
output = fn(session_key, True)
File "C:\Program Files\Splunk\etc\apps\SplunkEnterpriseSecuritySuite\bin\install\essinstaller2.py", line 48, in wrapper
r = f(self, *args, **kwargs)
File "C:\Program Files\Splunk\etc\apps\SplunkEnterpriseSecuritySuite\bin\install\essinstaller2.py", line 440, in stage_install_apps
for app, filename, upgrade, status, msg in self.install_apps(self.installable_apps, self.install_src_dir, session_key, raise_all_errors):
File "C:\Program Files\Splunk\etc\apps\SplunkEnterpriseSecuritySuite\bin\install\essinstaller2.py", line 203, in _install_apps
status = install_app(app, os.path.join(srcdir, filename), upgrade, session_key, self.timeout)
File "C:\Program Files\Splunk\etc\apps\SplunkEnterpriseSecuritySuite\bin\install\app_install_utils.py", line 159, in install_app
response, unused_content = splunk.rest.simpleRequest(uri, sessionKey=session_key, method='POST', timeout=timeout, postargs=postargs, raiseAllErrors=False)
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\rest__init_.py", line 500, in simpleRequest
raise splunk.SplunkdConnectionException, 'Error connecting to %s: %s' % (path, str(e))
SplunkdConnectionException: Splunkd daemon is not responding: ('Error connecting to /services/apps/local: [Errno 10054] Une connexion existante a d\xfb \xeatre ferm\xe9e par l\x92h\xf4te distant',)
ERROR install_apps failed."

The OS of the server Splunk is Windows Server 2016.

The application ES that i try to install is 5.2.2

I will appreciate your help.

Thanks,
Best Regards,

[lkutch_splunk]

Hi,
Is it the 14637 issue?
https://docs.splunk.com/Documentation/ES/5.2.2/RN/KnownIssues

[splunker2020]

Hi ,

No , isn't the 14637 issue because the Splunk Web start with this error message .

Unable to initialize modular input "ess_content_importer" defined inside the app "SplunkEnterpriseSecuritySuite": Introspecting scheme=ess_content_importer: script running failed (exited with code 1).

Also , when I open the ES application this error appear:

|essinstall-order generate an error

Thanks,