Splunk ITSI

Why does kvstore_to_json.py fail to update kpi threshold templates?

wmuselle
Path Finder

when doing a partial backup (GUI)/restore (CLI),

it fails with the message:

 

 

process:17394 thread:MainThread ERROR [itsi.migration] [__init__:1413] [exception] Object names must be unique for object type: kpi_threshold_template. List of duplicate names: [omitted list of duplicate objects].
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/SA-ITOA/lib/migration/migration.py", line 200, in migration_bulk_save_to_kvstore
    handler.migration_save_single_object_to_kvstore(object_type=object_type, validation=validation, dupname_tag=dupname_tag, skip_local_failure=skip_local_failure)
  File "/opt/splunk/etc/apps/SA-ITOA/lib/migration/object_interface/itoa_migration_interface.py", line 130, in migration_save_single_object_to_kvstore
    skip_local_failure=skip_local_failure)
  File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_common.py", line 1026, in save_batch
    skip_local_failure=skip_local_failure)
  File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 431, in save_batch
    transaction_id=transaction_id, skip_local_failure=skip_local_failure)
  File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 169, in do_object_validation
    raise e
  File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 164, in do_object_validation
    self.validate_identifying_name(owner, objects, dupname_tag, transaction_id)
  File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 232, in validate_identifying_name
    409
  File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_common.py", line 949, in raise_error_bad_validation
    raise ItoaValidationError(message, logger, self.log_prefix, status_code=status_code)
ITOA.itoa_exceptions.ItoaValidationError: Object names must be unique for object type: kpi_threshold_template. List of duplicate names: [omitted list of duplicate objects].

 

 

 

I tried using the -e switch documented (I tried even if it only renames services/entities), https://docs.splunk.com/Documentation/ITSI/4.4.5/Configure/kvstorejson

when removing the json file that has the KPI Threshold templates, the script successfully creates/updates all other objects.

to be complete, this is the CLI call: 

 

 

/opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/SA-ITOA/bin/kvstore_to_json.py -i -d -n -f /home/<myuser>/depot/itsi/itsi_configurations/ -u admin -p <cut> -v -e dup_202208161350

 

 

 

any pointers? 

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...