Splunk Enterprise

Can not mongo from 3.6 to version v4.2 on Splunk 8.1

ribentrop
Explorer

Hello, Splunkers!

I'v just change storageEngine to wiredTiger on my single instance.

 

[root@splunk-1 opt]# /opt/splunk/bin/splunk version
Splunk 8.1.10.1 (build 8bfab9b850ca)
[root@splunk-1 opt]# /opt/splunk/bin/splunk show kvstore-status --verbose

 This member:
                           backupRestoreStatus : Ready
                                          date : Wed Apr 23 09:56:56 2025
                                       dateSec : 1745391416.331
                                      disabled : 0
                                          guid : 3FA11F27-42E0-400A-BF69-D15F6B534708
                             oplogEndTimestamp : Wed Apr 23 09:56:55 2025
                          oplogEndTimestampSec : 1745391415
                           oplogStartTimestamp : Wed Apr 23 09:50:13 2025
                        oplogStartTimestampSec : 1745391013
                                          port : 8191
                                    replicaSet : 3FA11F27-42E0-400A-BF69-D15F6B534708
                             replicationStatus : KV store captain
                                    standalone : 1
                                        status : ready
                                 storageEngine : wiredTiger

 KV store members:
        127.0.0.1:8191
                                 configVersion : 1
                                  electionDate : Wed Apr 23 09:55:23 2025
                               electionDateSec : 1745391323
                                   hostAndPort : 127.0.0.1:8191
                                    optimeDate : Wed Apr 23 09:56:55 2025
                                 optimeDateSec : 1745391415
                             replicationStatus : KV store captain
                                        uptime : 95

 

Now I'm trying to upgrade mongo version from 3.6 to version v4.2. According to mongod.log my current version is:

 2025-04-23T06:55:21.374Z I CONTROL  [initandlisten] db version v3.6.17-linux-splunk-v4

 

Now according to docs I'm trying to migrate to another version of mongo manually but get the following message:

[root@splunk-1 opt]# /opt/splunk/bin/splunk migrate migrate-kvstore
[App Key Value Store migration] Collection data is not available.

 

Whst Splunk means by that? "Collection data is not available". I have several collections in my Splunk. I haven't found any case in Community. In normal cases Splunk replies in something like "Collection data is not available" .

It seems that I do something wrong in genelal

Thanks

 

Labels (1)
Tags (2)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @ribentrop 

Based on your kvstore status output it looks like the upgrade has already been completed. I think you would see that message if there no collections to be converted to wiredTiger.

  • Are there subdirectories and files in $SPLUNK_HOME/var/lib/splunk/kvstore/mongo?
  • Look for .wt files (WiredTiger), or collection*, index* files (old mmapv1).

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

ribentrop
Explorer

Hi @livehybrid !

Thank for yuou response.


  • Are there subdirectories and files in $SPLUNK_HOME/var/lib/splunk/kvstore/mongo?
  • Look for .wt files (WiredTiger), or collection*, index* files (old mmapv1).

 


Actually they are:

[root@splunk-1 splunk]# ll /opt/splunk/var/lib/splunk/kvstore/mongo | grep wt | wc -l
54


 But my question is actually about mongo version. Here it is on Splunk 8.1

[root@splunk-1 splunk]# /opt/splunk/bin/splunk cmd mongod --version
db version v3.6.17-linux-splunk-v4

 

So I want it to upgrade to 4.2 via command /opt/splunk/bin/splunk migrate /opt/splunk/bin/splunk migrate but still no luck and no any error info.

0 Karma

ribentrop
Explorer

Missprint here:

In normal cases Splunk replies in something like "[App Key Value Store migration] Starting migrate-kvstore." .

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...