Splunk upgrade 9.3 to 9.4 mongodb error

[Warren_Laya]

Hi All

Upgrading on prem from 9.3 to 9.4 and getting this error on mongod which Iv never had before:

The server certificate does not match the host name. Hostname: 127.0.0.1 does not match SAN(s):

This makes sense since I am using a custom cert and 127.0.0.1 isnt on it, the cert is a wildcard cert I use internally so messing with the hosts file wont work, is there a way to get mongod to either ignore the cer SAN's or to change the connect string for mongo so that its connecting to the FQDN rather than 127.0.0.1

[bluelobster]

If you use Splunk Cloud, the issue might be related to the splunkclouduf.spl credential package. There is a workaround:

https://splunk.my.site.com/customer/s/article/KV-store-status-failed-after-upgrade-to-9-4

Be aware that you will have to combine these three certs (instead of the two included in the guide) in this order for the Find more Apps page to work properly:

$SPLUNK_HOME/etc/auth/appsCA.pem
$SPLUNK_HOME/etc/auth/cacert.pem
$SPLUNK_HOME/etc/apps/100_<stackname>_splunkcloud/default/<stackname>_cacert.pem

[isoutamo]

Hi

i think that this is the correct instruction for this case https://splunk.my.site.com/customer/s/article/KV-Store-Error-after-upgrading-Splunk-Enterprise

The issue is with server name, not with CA.

So try to disable sslVerifyServerName attribute like above instruction is guided.

r. Ismo

[myitlab42000]

hi,

i don't know if it is the same issue but could you check this requirements. For example, is your cpu supported avx / avx2 instructions, if yes, is it enabled ?

https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/MigrateKVstore

https://www.mongodb.com/docs/manual/administration/production-notes/

i hope this help

[n8o]

If you're still experiencing issues, please take a look here https://splunk.my.site.com/customer/s/article/KV-store-status-failed-after-upgrade-to-9-4

The suggestion of concatenating CA certs resolved the errors and Splunk was able to upgrade/initialize kvstore after a restart of splunkd.

[dominikatvastli]

I have the same issue

[Warren_Laya]

I dont have a resoluton here, this is the documentation and the issue is around certs but I still cant work out where im going wrong.

Upgrade the KV store server version - Splunk Documentation

Im just going to wait for a new version where this is resolved.