I upgraded from 7.1.3 to 7.2.0 as stated in the title, there were no errors with the upgrade and everything seemed to start alright. Upon logging in I was greeted with the following three messages: Failed to start KV Store process. See mongod.log and splunkd.log for details. 10/2/2018, 4:38:28 PM KV Store changed status to failed. KVStore process terminated. 10/2/2018, 4:38:27 PM KV Store process terminated abnormally (exit code 62, status exited with code 62). See mongod.log and splunkd.log for details. 10/2/2018, 4:38:27 PM Looking through the mongod.log file I found the following: 2018-10-02T20:38:27.219Z I STORAGE [initandlisten] 2018-10-02T20:38:27.219Z I STORAGE [initandlisten] ** WARNING: Readahead for /opt/splunk/var/lib/splunk/kvstore/mongo is set to 4096KB 2018-10-02T20:38:27.219Z I STORAGE [initandlisten] ** We suggest setting it to 256KB (512 sectors) or less 2018-10-02T20:38:27.219Z I STORAGE [initandlisten] ** http://dochub.mongodb.org/core/readahead 2018-10-02T20:38:27.220Z I JOURNAL [initandlisten] journal dir=/opt/splunk/var/lib/splunk/kvstore/mongo/journal 2018-10-02T20:38:27.220Z I JOURNAL [initandlisten] recover : no journal files present, no recovery needed 2018-10-02T20:38:27.267Z I JOURNAL [durability] Durability thread started 2018-10-02T20:38:27.267Z I JOURNAL [journal writer] Journal writer thread started 2018-10-02T20:38:27.292Z I CONTROL [initandlisten] 2018-10-02T20:38:27.292Z I CONTROL [initandlisten] ** WARNING: No SSL certificate validation can be performed since no CA file has been provided 2018-10-02T20:38:27.292Z I CONTROL [initandlisten] ** Please specify an sslCAFile parameter. 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'. 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] ** We suggest setting it to 'never' 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/defrag is 'always'. 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] ** We suggest setting it to 'never' 2018-10-02T20:38:27.293Z I CONTROL [initandlisten] 2018-10-02T20:38:27.319Z F CONTROL [initandlisten] ** IMPORTANT: UPGRADE PROBLEM: The data files need to be fully upgraded to version 3.4 before attempting an upgrade to 3.6; see http://dochub.mongodb.org/core/3.6-upgrade-fcv for more details. After the IMPORTANT tag the DB process exits. Does anyone know how to either manually upgrade the database to 3.6 or how to purge and recreate it? I cannot seem to locate any information on this. The troubleshooting page wasn't a help in this instance as I already knew the service was failed and likely why. I have verified that the path to the DB is correct as well and verified permissions were alright. I also tried deleting the lock file and restarting to find the same error message. Thanks for any help! ... View more

I am trying to create a search that is pulling geographic IP information about the users and showing which server was getting the requests at that location. I have this working completely and showing the host being queried from a location, but I want to rename the output hosts .Example, we have server1 which hosts website1.com, server2 that hosts website2.com and so on. I would like the geostats graphs to show the "website1.com" tag that I set instead of the host "server1" so it is easier to read for those with no network familiarity. The code I have right now is as follows: host="server1" AS OR host="server2" OR host="server3" OR host="server4" OR host="server5" OR host="server6" OR host="server7" | rex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | where NOT cidrmatch("##.##.#.#/##",src_ip) | iplocation src_ip | geostats count by host ... View more