|
I was running 4.2 under FreeBSD without any problems. Now I have applied the upgrade to 4.3 on the same system (by unpacking the tarball as per documentation). Everything starts and my apps appear to be there. If I choose the standard search app, use "*" and select realtime (1 hour window), I get the following URL presented http://etau-net-001:8000/en-GB/app/search/flashtimeline?q=search%20*&earliest=rt-1h&latest=rt However I get this error: Splunk cannot find the "flashtimeline" view. This page was linked to from http://etau-net-001:8000/en-GB/app/search/dashboard_live. I am presuming some configuration got trampled in the upgrade because this is supposed not to use flash now? Thanks in advance |
|
This error appears when there was no migration or it failed during the upgrade process. Workaround is to force migration to correct the issue. From $SPLUNK_HOME : |
|
This seems like some kind of migration or packaging error. For this kind of troubleshooting problem, you should definitely open a Splunk Support case. As a kludge, copying in a flashtimeline.xml file (from the package, or a backup) to etc/apps/search/default/data/ui/views may get you going again. Even if this works, I recommend opening a case -- there might be changes to that view for 4.3, and the problem may be broader. To my knowledge, we still keep the flashtimeline view, even though it typically won't have any flash in it, too much used the name. Most likely if you copy your own flashtimeline.xml file back into place, things will work, but I don't currently know about any view system changes that are related, so this text will neeed updating. Platform (i see this is tagged freebsd, but arch and version would be nice), version migrated from, and package used (like.. the precise tarball name for example) would be v nice. |
