Splunk Enterprise

Can not mongo from 3.6 to version v4.2 on Splunk 8.1

ribentrop
Explorer

Hello, Splunkers!

I'v just change storageEngine to wiredTiger on my single instance.

 

[root@splunk-1 opt]# /opt/splunk/bin/splunk version
Splunk 8.1.10.1 (build 8bfab9b850ca)
[root@splunk-1 opt]# /opt/splunk/bin/splunk show kvstore-status --verbose

 This member:
                           backupRestoreStatus : Ready
                                          date : Wed Apr 23 09:56:56 2025
                                       dateSec : 1745391416.331
                                      disabled : 0
                                          guid : 3FA11F27-42E0-400A-BF69-D15F6B534708
                             oplogEndTimestamp : Wed Apr 23 09:56:55 2025
                          oplogEndTimestampSec : 1745391415
                           oplogStartTimestamp : Wed Apr 23 09:50:13 2025
                        oplogStartTimestampSec : 1745391013
                                          port : 8191
                                    replicaSet : 3FA11F27-42E0-400A-BF69-D15F6B534708
                             replicationStatus : KV store captain
                                    standalone : 1
                                        status : ready
                                 storageEngine : wiredTiger

 KV store members:
        127.0.0.1:8191
                                 configVersion : 1
                                  electionDate : Wed Apr 23 09:55:23 2025
                               electionDateSec : 1745391323
                                   hostAndPort : 127.0.0.1:8191
                                    optimeDate : Wed Apr 23 09:56:55 2025
                                 optimeDateSec : 1745391415
                             replicationStatus : KV store captain
                                        uptime : 95

 

Now I'm trying to upgrade mongo version from 3.6 to version v4.2. According to mongod.log my current version is:

 2025-04-23T06:55:21.374Z I CONTROL  [initandlisten] db version v3.6.17-linux-splunk-v4

 

Now according to docs I'm trying to migrate to another version of mongo manually but get the following message:

[root@splunk-1 opt]# /opt/splunk/bin/splunk migrate migrate-kvstore
[App Key Value Store migration] Collection data is not available.

 

Whst Splunk means by that? "Collection data is not available". I have several collections in my Splunk. I haven't found any case in Community. In normal cases Splunk replies in something like "Collection data is not available" .

It seems that I do something wrong in genelal

Thanks

 

Labels (1)
Tags (2)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @ribentrop 

Based on your kvstore status output it looks like the upgrade has already been completed. I think you would see that message if there no collections to be converted to wiredTiger.

  • Are there subdirectories and files in $SPLUNK_HOME/var/lib/splunk/kvstore/mongo?
  • Look for .wt files (WiredTiger), or collection*, index* files (old mmapv1).

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

ribentrop
Explorer

Hi @livehybrid !

Thank for yuou response.


  • Are there subdirectories and files in $SPLUNK_HOME/var/lib/splunk/kvstore/mongo?
  • Look for .wt files (WiredTiger), or collection*, index* files (old mmapv1).

 


Actually they are:

[root@splunk-1 splunk]# ll /opt/splunk/var/lib/splunk/kvstore/mongo | grep wt | wc -l
54


 But my question is actually about mongo version. Here it is on Splunk 8.1

[root@splunk-1 splunk]# /opt/splunk/bin/splunk cmd mongod --version
db version v3.6.17-linux-splunk-v4

 

So I want it to upgrade to 4.2 via command /opt/splunk/bin/splunk migrate /opt/splunk/bin/splunk migrate but still no luck and no any error info.

0 Karma

ribentrop
Explorer

Missprint here:

In normal cases Splunk replies in something like "[App Key Value Store migration] Starting migrate-kvstore." .

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...