Unforseen Error during upgrade from enterprise 8.2.9 to 9.0.4.1?

[JAvnaim]

Hello All,

I receive the following error after starting Splunk enterprise for the first time after an upgrade from 8.2.9 to 9.0.4.1 ; otherwise no other problem seen prior:

Exception: <class 'UnicodeDecodeError'>, Value: 'utf-8' codec can't decode byte 0xff in position 0: invalid start byte

Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1212, in main
parseAndRun(argsList)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1067, in parseAndRun
retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 293, in call
return self.func(args, fromCLI)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/control_api.py", line 35, in wrapperFunc
return func(dictCopy, fromCLI)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/_internal.py", line 189, in firstTimeRun
migration.autoMigrate(args[ARG_LOGFILE], isDryRun)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3379, in autoMigrate
migrate_add_default_dashboard_xml_version_1_1(dryRun)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3131, in migrate_add_default_dashboard_xml_version_1_1
dashboard_contents = f.read()
File "/opt/splunk/lib/python3.7/codecs.py", line 322, in decode
(result, consumed) = self._buffer_decode(data, self.errors, final)
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xff in position 0: invalid start byte

Any help would / pointers would be appreciated!

~J

[ThiloMüller]

We had the same issue when migrating from 8.2.11 to 9.0.5.

I found a file (with the unix "file" command) with "different" settings in the directory that was processed before this "unforeseen error" occurred, in our case the effected file was:

/opt/splunk/etc/apps/ForensicInvestigator/default/data/ui/views/portsservices.xml: HTML document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators

After converting this file (by "iconv -f UTF-16LE -t UTF-8") the command "/opt/splunk/bin/splunk start" executed without error.

[glc_slash_it]

Hi,

have you tried to repeat the installation of 9.0.4.1?

[srinivasmanikan]

i tried couple of time for the same error but seen the same error. after that i tried above work around  

$SPLUNK_HOME/etc/apps/ForensicInvestigator/default/data/ui/views


iconv -f UTF-16LE -t UTF-8 portsservices.xml -o portsservices1.xml

i removed the old file and renamed the portsservices1.xml to portsservices.xml and it worked for me 

after that i started the splunk everything is working as expected.

[JAvnaim]

I did not; I reverted back to 8.2.9 and restored the config back up. All is well now. Eventually will need to upgrade to 9x though.

[glc_slash_it]

What kind of Splunk instance is this you're trying to update? (HF, UF, Indexer, SH?)

Have you tried to submit a ticket to Splunk support? They can definitely help you in this upgrade situation.