About Snorre

Snorre

Thanks for getting back to me. I started to look into the /etc/licenses folder and I toyed around with the files there, and now I think I figured out what is happening: If I install a Dev key in the Prod environment, splunk deletes all Prod keys in the folder and creates a Restart required message in the dashboard. After restart only the files installed after the dev key is loaded. I might very well have installed a new dev key in the prod environment as I received a renewal keys for both prod and dev in the same email. We will ask the maintenance team for a restore of the files in the licenses folder and it will probably be sorted. It would be great if splunk could show a warning when I try to do such stupid things as uploading a dev license in the prod environment, or maybe even a backup of the license files when deleting them, but I have learned now and wont be doing that again 🙂

Snorre

I added a 30gb renewal license key that is valid from June 14th later this year. Afterward I got a message telling me to restart Splunk. I did that, and now all other licenses are missing from the License admin console. Anyone experienced this before? Is there a way to recover the old licenses? Running splunk Enterprise 9.2.0.1 on prem on redhat

Snorre · ‎03-12-2024

I started using Process Monitor from SysInternals to see what files the migration tool had problems with and when I fixed permissions on those the problem was fixed.

Snorre · ‎03-12-2024

I'm trying to migrate kvstore on a v8.2 installation on Windows, but it fails early in the process. splunk migrate kvstore-storage-engine --target-engine wiredTiger ERROR: Cannot get the size of the KVStore folder at=E:\Splunk\Indexes\kvstore\mongo, due to reason=3 errors occurred. Description for first 3: [{operation:"failed to stat file", error:"Access is denied.", file:"E:\Splunk\Indexes\kvstore\mongo"}, {operation:"failed to stat file", error:"Access is denied.", file:"E:\Splunk\Indexes\kvstore\mongo"}, {operation:"failed to stat file", error:"Access is denied.", file:"E:\Splunk\Indexes\kvstore\mongo"}] I've tried to do file operations on the folder and subfolders of E:\spunk\indexes\kvstore\mongo and everything seems ok. The mongod.log does not contain any rows from the migration. Any nudges in the right direction? Can I upgrade to 9.1 without migrating the store?

Snorre · ‎12-07-2023

Hi I'm upgrading and migrating my Splunk enterprise 8.1.1 running on windows server 2012 R2. Anyone have a recommended path for this? Upgrade first, or migrate first? Usually I would prefer to upgrade first, but I see that 8.2 is not supported on windows server 2012 R2.

Snorre · ‎08-02-2022

I'm trying to upgrade from splunk 8.1 to 9.0 on a single server Windows installation. Upgrading the kvstore from mmapv1 to wiredtiger caused me some headache, but it eventually seems to work. The problem now is that I'm stuck on wiredTiger 4.0, and can't find a way to get it upgraded to 4.2. splunkd.log contains this error message: 08-03-2022 07:58:43.566 +0200 ERROR KVStoreBulletinBoardManager [7688 MainThread] - Failed to upgrade KV Store to the latest version. KV Store is running an old version, service(40). Resolve upgrade errors and try to upgrade KV Store to the latest version again. But I can't find anything else useful in the logs. splunk show kvstore-status --verbose Any hints as to how to find out whats wrong? Or how to force the upgrade? I tried to delete the mongod-4.0.exe but that caused the kvstore to fail at startup.

Posts	6
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-02-2022

Online Status	Offline
Date Last Visited	2 weeks ago

License keys disappear after restart

Failed to stat file, migrating kvstore v8.2

Migration path for windows 2012, splunk 8.1.1

Why are we getting this error after wiredTiger upg...

Re: License keys disappear after restart

License keys disappear after restart

Re: Failed to stat file, migrating kvstore v8.2

Failed to stat file, migrating kvstore v8.2

Migration path for windows 2012, splunk 8.1.1

Why are we getting this error after wiredTiger upg...

Are you a member of the Splunk Community?