After indexer cluster upgrade to Splunk 6.3, why are we getting search error...
We have Splunk Enterprise and our cluster consists of 3 search heads and 9 search peers. After upgrading to version 6.3, the following started to happen. Although the cluster in total has enough space,...
View ArticleAfter upgrading my search head and indexer to Splunk 6.3.1, why am I seeing a...
Hello, all. I upgraded my single search head and indexer to version 6.3.1. I am aware of the CPU resource improvements with this release, however, I've noticed a slight decrease in performance (UI...
View ArticleUpgrading Splunk on Windows 2008 R2, how can I uninstall the universal...
Hi, I am trying to upgrade Splunk version on Windows 2008 R2. Can you suggest me any way to uninstall Splunk universal forwarder as it is not showing universal forwarder in control panel? I have tried...
View ArticleAfter upgrading to Splunk 6.3, why do users have to constantly clear the...
Hi, So we have 2 instances of Splunk installed, both of which have been upgraded to 6.3 over the past month or so. Both of the setups are very different so the only similarity is the version upgrade....
View ArticleAfter upgrading Splunk Enterprise Security 3.3.0 to 4.0 for Splunk 6.3.1 on...
We were upgrading Splunk Enterprise Security 3.3.0 to ES 4.0 on Windows 2012 running Splunk 6.3.1. We ran into errors with Splunk ES 4.0 hanging up during the configuration phase. We did the manual...
View ArticleAfter upgrading Splunk, why am I getting error "Cannot find any source of...
After upgrading Splunk, I see the following error (in bold) when Splunk is started: ---------- Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking...
View ArticleAfter upgrading from Splunk 6.1.3 to 6.3.1, why is my license showing as...
I proceeded to Splunk version upgrade from 6.1.3 to 6.3.1 and I am having a problem that license has expired or is not recognized. The license is 2GB and expires in September 2017. My server is running...
View ArticleWhy are my props.conf settings not being applied to my data after upgrading...
Here's my local props.conf. [tmweb@app1.splunkdev.jetdev2.syseng.tmcs ~]$ cat /opt/splunk-efr/splunk/etc/system/local/props.conf [default] TRUNCATE=100 TIME_PREFIX = datetime= TIME_FORMAT =...
View ArticleHow do we upgrade our 3 indexer cluster to a 4 indexer cluster with the...
We have a distributed clustered environment and need to upgrade it to the latest version. The plan is to install the latest version on a new set of physical servers. How do we migrate the old data from...
View ArticleCan we have the same source forwarding data to two different Splunk...
As part of the upgrade we are planning to deploy Splunk 6.3 on a new set of physical servers. We have around 217 forwarders sending data in the existing infrastructure. Can we have the forwarders...
View ArticleWhy are my props.conf settings not being applied to my data
Here's my local props.conf. [tmweb@app1.splunkdev.jetdev2.syseng.tmcs ~]$ cat /opt/splunk-efr/splunk/etc/system/local/props.conf [default] TRUNCATE=100 TIME_PREFIX = datetime= TIME_FORMAT =...
View ArticleAfter upgrading from Splunk 6.1.7 to 6.3.1, why does Splunk report that it is...
I've upgraded Splunk from 6.1.7 to 6.3.1. Splunk Help->About now says: "Splunk Version 4.0, Splunk Build 000, Current App Search & Reporting, App Version 6.3.1, Server Name N/A". Why? Does this...
View ArticleWhy won't splunkweb start after upgrade from Splunk 4.1.5 to 4.3.7 with error...
I have a really old 4.1.5 instance on Ubuntu 8.04. I am finally upgrading to 6.3.1 (through 4.3.7 first). I provisioned a new Ubuntu 14.04 server of the same bit-ness as the old server (32-bit) and...
View ArticleAfter upgrading Splunk DB Connect from 1.1.x to 1.2.x and Java 8, why am I...
I have the exact problem detailed here: https://answers.splunk.com/answers/234840/db-connect-12-java-8-mssql-integrated-authenticati I upgraded DB Connect from 1.1.x to 1.2.x and upgraded Java to 8 and...
View ArticleHow do I correctly upgrade the DB2 driver on the Splunk DB Connect app?
I am having trouble upgrading the DB2 driver from v9.7 FP10 to 10.5 FP4 on my Splunk DB Connect app. I am currently on v6.3.0 of Splunk and have v1.1.6 of the Splunk DB Connect app. I have followed the...
View ArticleHow do I correctly upgrade the DB2 driver on the Splunk DB Connect 1.1.6 app?
I am having trouble upgrading the DB2 driver from v9.7 FP10 to 10.5 FP4 on my Splunk DB Connect app. I am currently on v6.3.0 of Splunk and have v1.1.6 of the Splunk DB Connect app. I have followed the...
View ArticleWhat would be the best way to upgrade our Splunk environment and add...
I have an existing Splunk setup with 2 indexers and 2 forwarders with a clustered architecture. Now we are trying to upgrade and introduce new h/w for syslog and additional forwarders and indexers....
View Article6.3.2 Peer Indexer Upgrades - FYI, I resolved this problem during my upgrade.
I upgraded my test instances to 6.3.2 this week and encountered something odd while upgrading my indexer cluster. I had first successfully upgraded a standalone instance and a heavy forwarder, but my...
View ArticleUpgraded Splunk Universal Forwarder 6.3.1 (build f3e41e4b37b2) from 5.07 and...
Hello Splunkers, I had an issue with a Splunk Universal Forwarder 6.3.1 (build f3e41e4b37b2) upgrade recently and I wanted to share with you the issue and its resolution. Knowing that this could happen...
View ArticleJMS inputs are not visible after upgrade to Splunk 6.3.0 and upgrade to JMS...
JMS inputs are not visible after upgrade to 6.3.0 Enterprise and upgrade to JMS 1.5. Within Settings-->Data Inputs--> No more 'JMS' input link so the inputs must be managed directly on the...
View Article