Splunk Enterprise

Why is there an error while performing "Migrate KV store to the WiredTiger storage engine"?

fortes777
Engager

I am on Splunk 8.2.4

While performing "Migrate the KV store after an upgrade to Splunk Enterprise 8.1 or higher in a clustered deployment"  (see https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/MigrateKVstore )

splunk start-shcluster-migration kvstore -storageEngine wiredTiger -isDryRun true

I'm getting message "Admin handler 'shclustercaptainkvstoremigrate' not found."

Searh Head KV_Store is up and running. Splunk 8.2.4

I can't find any troubleshoot topic. Does anyone know how to fix this issue?

Labels (1)
1 Solution

gjanders
SplunkTrust
SplunkTrust

Search head cluster or standalone search head?

And did you setup the server.conf as per the docs pre-migration?

View solution in original post

0 Karma

joe_mcmahon
Engager

I had this error appear too, but only because I skipped a step.  The rolling restart of the clustered search heads was critical after making the following server.conf change:

[kvstore]
storageEngineMigration=true

 Once the rolling restart of the search heads completes, then enter the command:

splunk start-shcluster-migration kvstore -storageEngine wiredTiger

 The response should read "Starting KVStore Migration".  Check the migration status via:

splunk show shcluster-kvmigration-status
0 Karma

ammara
Explorer

I seem to be having the same problem. Looks like there is something wrong with the command

0 Karma

fortes777
Engager

Search Head cluster and i added the [kvstore] stanza in server.conf (as described) before executing the dry run.

0 Karma

gjanders
SplunkTrust
SplunkTrust

There might be a log relating to the migration in $SPLUNK_HOME/var/log/splunk

However this is potentially support case territory now, and you may wish to log a case

0 Karma

gjanders
SplunkTrust
SplunkTrust

Search head cluster or standalone search head?

And did you setup the server.conf as per the docs pre-migration?

0 Karma

TheBravoSierra
Path Finder

I'm having the same issue...please advise. I have made appropriate changes to server.conf on shc nodes. 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...