Splunk Enterprise

Splunk 9 Universal Forwarder getting "[App Key Value Store migration] " error after upgrade from Splunk 8.2.4

vksplunk1
Explorer

Hi ,

Splunk 9 Universal Forwarder getting "[app key value store migration collection data is not available] " error after upgrade from Splunk 8.2.4.    Splunk is not starting

 

app key value store migration collection data is not available

 

Why is UF is looking for KV Store ?

 

Any suggestion to resolve it

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this is a known issue on those 9.0.x UF even it's not documented on release notes!

You can try to add this to the server.conf

[kvstore]
disabled = true

 and test it this helps.

Anyhow there shouldn't be any kvstore running on UFs! It's only needed on search heads.

r. Ismo

likedasplunk
Path Finder

@isoutamo 

I added that stanza to server.conf and I still get prompted for interactive login. No matter what I do or try, I still get prompted for Nix UF 9.0.3. Is there any update on this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...