Splunk Search

Splunk upgrade from 5.0.9 to 6.1.2: Why can't I search?

rmorlen
Splunk Employee
Splunk Employee

Upgraded from Splunk 5.0.9 to 6.1.2. Can't search. Seeing the following message: "In handler 'jobs': Cannot perform action "POST" without a target name to act on.".

Anyone have any suggestions where I can look for a fix?

Tags (2)

andrewfoglesong
Explorer

You can run the splunk btool --debug tool. I had several "No spec file for: ... .conf" entries after moving from 5.0.4 to 6.2.3. Then I remembered I had some sandboxing app with copies of ALL the default configuration files in it. I removed the app, restarted Splunk, and everything appeared to work after that.

My guess is that there are some incompatibilities between the different configuration stanzas and syntax of 5/6 and that while the migration will overwrite the conflicts in the /default paths, it won't touch conflicting settings if they are somewhere else (i.e., /apps). I thought Splunk 5 actually included some deprecated setting stanzas from 4 to avoid this but it doesn't seem to be 100% true going from 5 to 6.

0 Karma

rmorlen
Splunk Employee
Splunk Employee

Thanks. Yes I filed a case with support.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The first step towards debugging would be to look into the _internal index at the time of that error for further info.

Did you file a case with support?

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...