An attempt was made to upgrade Splunk 4.2.2 to 4.3. However, the incorrect Splunk_Home was used, namely the Splunk location was entered as /opt/splunk when it should have been just /opt. Therefore the upgrade went into the directory structure /opt/splunk/splunk. I had a backup of the original structure, but for some reason I wasn't able to remove the upgrade using rpm -e. I would get a message saying that it couldn't be found, yet I couldn't reinstall it because it was already there.
So, it was suggested by another that I copy the /opt/splunk/splunk structure to a temporary location, remove the /opt/splunk/splunk structure, and then copy the temporary structure back to /opt/splunk. That was fine, but I then didn't have my data in the /opt/splunk/etc directory. So the suggestion was made to delete the /opt/splunk/etc directory and then copy that directory from my backup from 4.2.2. This was done. It was only later after going through the 4.3 tutorials that I realized that there had been 4.3 specific data in the /opt/splunk/etc directory that I now didn't have.
So, the question is how to proceed from this point. If I could remove the upgrade using rpm -e, then I coould just delete the /opt/splunk directory, and copy it back from my backup and then reapply the upgrade rpm.
I also see that there is not nearly as much data indexed as there was previously, so that things being searched for are no longer there. Can I reindex the data? What would have caused data that had been indexed to no longer be indexed?
I tried submitting a support ticket but the support page always hangs upon submit (in any browser.)
asked 28 Feb '12, 11:07
Useful info on this topic can be found here:
Moving Splunk indexer from one host to another host on Splunk Answers
Specific to your situation, I would uninstall Splunk, then do a new install of 4.3, and copy over the configuration from $SPLUNK_HOME/etc/apps/<appname> that were relevant, as well as the $SPLUNK_HOME/etc/system/local folders. You can also copy the indexed data from $SPLUNK_HOME/var/lib/splunk/<indexname> on the backup to the new instance in the same location under the $SPLUNK_HOME because the data format didn't change from 4.2 to 4.3. However, you need to be careful to avoid conflicting bucket ids. For details on that, see:
Moving indexes to a new Splunk server on Splunk Answers
If you do run into bucket id conflicts, see:
If you're having trouble submitting a support case, you may want to try calling support(presuming you have a enterprise support contract). This could be a tricky thing to do, so if you need to call, feel free. The contact number can be found here: