I didn't see mention of the issue in 9.0.3 but I can confirm that the issue is also in 9.0.3.  I implemented the recommended change and it resolved the error. sha256sum shows the following after making the change: e00229cf2b4fee8ecf2232d98358d1a32563bb7edf6a60ec2274e765fb51e22d savedsearches.conf Thanks all! I'm glad I wasn't the only one running into this. 🙂 ... View more

I just tried upgrading from Spunk Enterprise 8.1.3 to 8.2.0 on Ubuntu 20.04 and ran into the same issue but it doesn't look like the upgrade failed. sudo dpkg -i splunk-8.2.0-e053ef3c985f-linux-2.6-amd64.deb (Reading database ... 176294 files and directories currently installed.) Preparing to unpack splunk-8.2.0-e053ef3c985f-linux-2.6-amd64.deb ... This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server... Stopping splunkd... Shutting down. Please wait, as this may take a few minutes. Stopping splunk helpers... Done. Unpacking splunk (8.2.0) over (8.1.3) ... Setting up splunk (8.2.0) ... cp: cannot stat '/opt/splunk/etc/regid.2001-12.com.splunk-Splunk-Enterprise.swidtag': No such file or directory complete Even though the upgrade didn't appear to fail, I followed the same advice: cp splunk-Splunk-Enterprise-primary.swidtag /opt/splunk/etc/regid.2001-12.com.splunk-Splunk-Enterprise.swidtag I ran the installation again, and it completed successfully: sudo dpkg -i splunk-8.2.0-e053ef3c985f-linux-2.6-amd64.deb (Reading database ... 180376 files and directories currently installed.) Preparing to unpack splunk-8.2.0-e053ef3c985f-linux-2.6-amd64.deb ... This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server... splunkd is not running. Unpacking splunk (8.2.0) over (8.2.0) ... Setting up splunk (8.2.0) ... complete ... View more

@ITWhisperer thanks for your help. Everything is working as expected. ... View more

This issue occurs while installing Splunk, not during the startup. It's before Splunk is even started for the first time. I have verified that /opt/splunk and all subdirectories are owned by splunk:splunk I'm wondering if the message benign? ... View more

I am receiving the same error message when installing from: splunk-8.1.0-f57c09e87251-linux-2.6-amd64.deb I am using a fresh installation of Ubuntu 20.04 running on AWS from the AWS Marketplace image. user@vmserver:~$ sudo dpkg -i splunk-8.1.0-f57c09e87251-linux-2.6-amd64.deb Selecting previously unselected package splunk. (Reading database ... 63367 files and directories currently installed.) Preparing to unpack splunk-8.1.0-f57c09e87251-linux-2.6-amd64.deb ... Unpacking splunk (8.1.0) ... Setting up splunk (8.1.0) ... cp: cannot stat '/opt/splunk/etc/regid.2001-12.com.splunk-Splunk-Enterprise.swidtag': No such file or directory complete This is a Ubuntu Server VM, so there is no GUI for me to verify whether or not I get the same SSL error message. ... View more