- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Splunk Enterprise Security 6.2.0 Upgrade Failure
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Enterprise Security 6.2.0 Upgrade Failure
Recently upgraded Splunk Enterprise Security from 6.1.1 to 6.2.0, install went fine, however clicking on Setup gives me the following error, this happens for both my personal account and the embedded administrator account:
Error: You do not have the permissions to view this page.
Executed the following Search: "| essinstall --dry-run gives the following error:"
Error in 'essinstall' command: (Exception) Missing the capabilities to use essinstall command
If I investigate the Job Inspector/Search.log I find the following error:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/essinstall.py" line 385 in run while self._handle_chunk()
Logged into the Splunk server SSH/CLI itself and ran the command manually ("/opt/splunk/bin/splunk cmd python3 /opt/splunk/etc/apps/SplunkEnterpriseSecurity/bin/essinstall.py" as the splunk user and get the following error:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/bin/essinstall.py" line 14, in <module> import splunk.rest as rest
There is more to the error than the above, but figure I need to solve that issue first before worrying about the rest. Seems it cannot import splunk.rest?
Verified both the Splunk server is configured for python3 (not enforce) in local/server.conf as well as Splunk Enterprise Security which by default is python3 in inputs.conf, I don't have a custom inputs.conf in local for Splunk Enterprise Security
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Grant the current user to inherit the ess_admin role.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Should also add that if I "upgrade" back to 6.1.1, no issues. Only when I install 6.2.0 do I have issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry just getting back to this, user already has essadmin. Still the same error. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only thing I found worked was to perform the following steps:
1. Change directories to: /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install
2. Execute the following command: for i in *.spl; do /opt/splunk/bin/splunk install app $i; done
3. Change is_configured = 0 to is_configured = 1 in /opt/etc/apps/SplunkEnterpriseSecuritySuite/local/app.conf
3. Restart Splunk services
NOTE: Also works on 6.4.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
