About keishsplunk

keishsplunk · ‎07-17-2023

Change the SPL syntax as such - | tstats count where index=* by sourcetype,host | search sourcetype=* host=heavy-forwarder-1

keishsplunk · ‎05-01-2023

Hi All, we had successfully upgraded to Splunk 9.0.4. However, we observed that when using tstats command, we are getting the below message. normal searches are all giving results as expected. [indexer1,indexer2,indexer3,indexer4.indexer5] When used for 'tstats' searches, the 'WHERE' clause can contain only indexed fields. Ensure all fields in the 'WHERE' clause are indexed. Properly indexed fields should appear in fields.conf. Any idea why we are getting this and how to resolve it.

keishsplunk · ‎04-20-2023

Hi, We were able to resolve the issue by disabling one SH member at a time from clustering and upgrade the KV store of the clustering disable member as a standalone instance. We then followed the same steps for all members. Regards

keishsplunk · ‎04-13-2023

Hi Thanks for the response. reimport the data means the data from $SPLUNK_HOME/var/lib/splunk/kvstore directory. if we restore it wouldn't it have the older version file or datas ? Regards

keishsplunk · ‎04-13-2023

Hi Thanks for the response. We will try recreating the kvstore and also we are getting in touch with support team. Regards

keishsplunk · ‎04-12-2023

Hi The issue is with the SH clustered environment. The KV store server version migration didn't happen as part of splunk upgrade hence followed the below stops. curl -k -u admin:changeme https://localhost:8089/services/shcluster/captain/kvmigrate/start -d storageEngine=wiredTiger -d isDryRun=true splunk start-shcluster-migration kvstore -storageEngine wiredTiger -peersList "https://server1:8089,https://server2:8089,https://server3:8089" Upgrade KV store server to version 4.2 splunk start-shcluster-upgrade kvstore -version 4.2 -isDryRun true splunk start-shcluster-upgrade kvstore -version 4.2 However when running the command splunk show kvstore-status --verbose, it is still showing as the old version server. KV store members: np-sh-1:8191 configVersion : 14 electionDate : Wed Apr 12 06:02:53 2023 electionDateSec : 1681275773 hostAndPort : np-sh-1:8191 lastHeartbeat : Wed Apr 12 13:40:44 2023 lastHeartbeatRecv : Wed Apr 12 13:40:44 2023 lastHeartbeatRecvSec : 1681303244.627 lastHeartbeatSec : 1681303244.586 optimeDate : Wed Apr 12 13:40:32 2023 optimeDateSec : 1681303232 pingMs : 1 replicationStatus : KV store captain serverVersion : 3.6.17 uptime : 27479 np-sh-2:8191 configVersion : 14 hostAndPort : np-sh-2:8191 lastHeartbeat : Wed Apr 12 13:40:44 2023 lastHeartbeatRecv : Wed Apr 12 13:40:45 2023 lastHeartbeatRecvSec : 1681303245.54 lastHeartbeatSec : 1681303244.565 optimeDate : Wed Apr 12 13:40:32 2023 optimeDateSec : 1681303232 pingMs : 0 replicationStatus : Non-captain KV store member serverVersion : 3.6.17 uptime : 27475 np-sh-3:8191 configVersion : 14 hostAndPort : np-sh-3:8191 optimeDate : Wed Apr 12 13:40:32 2023 optimeDateSec : 1681303232 replicationStatus : Non-captain KV store member serverVersion : 3.6.17 uptime : 27483

keishsplunk · ‎04-11-2023

Hi, As i have mentioned in my first comment, we have followed the steps defined in the link. change the storage engine to wiredTiger is done. change the software version to 4.2 is not working.

keishsplunk · ‎04-11-2023

We have recently upgraded our splunk from 8.0.2 to 9.0.4. The SH cluster members are giving the message - "KV Store is running an old version, service(36). See the Troubleshooting Manual on KV Store upgrades for more information." We have followed the steps defined the KV migration link -https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/MigrateKVstore?ref=hk but the version doesn't seem to upgrade. It is always showing the existing version. Current serverVersion : 3.6.17 storageEngine : wiredTiger

Posts	8
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎04-11-2023

Online Status	Offline
Date Last Visited	‎07-17-2023 09:51 AM

How can I fix tstats error after upgrading to Splu...

Why is Splunk SH cluster KV store upgrade not work...

Re: How can I fix tstats error after upgrading to ...

How can I fix tstats error after upgrading to Splu...

Re: Splunk SH cluster KV store upgrade not working...

Re: Splunk SH cluster KV store upgrade not working...

Re: Splunk SH cluster KV store upgrade not working...

Re: Splunk SH cluster KV store upgrade not working...

Re: Splunk SH cluster KV store upgrade not working...

Why is Splunk SH cluster KV store upgrade not work...