Yes, I suspected that would happen, maybe try: 1. Stop Splunk if you can 2. Backup /opt/splunk/etc/apps folder (So you have your App configs at least) 3. For your data if you are using the defa...
See more...
Yes, I suspected that would happen, maybe try: 1. Stop Splunk if you can 2. Backup /opt/splunk/etc/apps folder (So you have your App configs at least) 3. For your data if you are using the default in $SPLUNK_HOME/var/lib/splunk folder - you can be move to a temp folder as well, but if you had a seperate volume even better - it wont get touched. 4. Re-install Splunk over the current broken install and see if that works (I suspect not) but worth a go 5. If it works restore the /opt/splunk/etc/apps folder and your data . (make sure you set the splunk permissions - chown -R splunk:splunk etc to the Splunk and data folders If that all fails, then may be wipe it clean and start again, if you keep it as it is not going to bode well for the future as you will have other upgrades to do in the future and it will always cause some kind of problem, so better to sort it all out now and make it clean. If it was me, I would start clean again, less issues in the longer run.