Splunk Enterprise

upgrade to kvstore v7 impossible on MacOS?!

schose
Builder

Hi all,

When upgrading from v9.4.1 to a newer version (including 10) on MacOS (arm) i receive the error message:

-> Currently configured KVSTore database path="/Users/andreas/splunk/var/lib/splunk/kvstore"
-> Currently used KVSTore version=4.2.22. Expected version=4.2 or version=7.0
CPU Vendor: GenuineIntel
CPU Family: 6
CPU Model: 44
CPU Brand: \x
AVX Support: No
SSE4.2 Support: Yes
AES-NI Support: Yes

 

There seems to be an issue with determine AVX correctly thru rosetta?! - Anyway, i tried to upgrade on v9.4.1using

~/splunk/bin/splunk  start-standalone-upgrade kvstore -version 7.0 -dryRun true

and receive the error

In handler 'kvstoreupgrade': Missing Mongod Binaries :: /Users/andreas/splunk/bin/mongod-7.0; /Users/andreas/splunk/bin/mongod-6.0; /Users/andreas/splunk/bin/mongod-5.0; /Users/andreas/splunk/bin/mongod-4.4; Please make sure they are present under :: /Users/andreas/splunk/bin before proceeding with upgrade.
Upgrade Path = /Users/andreas/splunk/bin/mongod_upgrade not found  Please make sure upgrade tool binary exists under /Users/andreas/splunk/bin

The error that mongod-4.4, mongod-5.0, mongod-6.0 and mongod-7.0 are missing is correct, the files are not there. There are not in delivered splunk .tgz for macos. The linux tarball includes them.. 

any hints?

best regards,

Andreas

Labels (1)
0 Karma

livehybrid
Ultra Champion

Hi @schose 

A full Splunk Enterprise installation is not currently supported for MacOS (See https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.0/plan-your-splunk-e...) - Only the UF package is supported, this could be for a number of reasons however MongoDB 5.0+ requires a CPU with AVX support which Silicon macs do not support (with Intel macs aging out).

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

schose
Builder

Hi @livehybrid,

Well, strange thing is that mongo7 is working for splunk v10 when installing vanilla.

I would strongly guess that the update even does not work on intel macs also, because the mongo binaries needed for migration are not the in macos intel tarball. 

Cheers,

Andreas

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...