I have upgraded one of my Splunk servers from version 4.1.7-95063 to version 4.2-96430. The server has stopped collecting data since.
I mainly have a several scripts that run from /prod/products/splunk/etc/bundles
the scripts are configured using inputs.conf props.conf
It looks to me that the files inputs.conf props.conf are not being used by Splunk 4.2 to collect data. When I wen into Maganger --> Data Input --> Script I do not see any of my 300+ scripts.
Is there a way I can get this working? This is the first time I am experiencing this kind of issue. I usually keep up to date with the latest Splunk version.
Thanks, Dan
Thank you for your answer. I tried that but after restarting Splunk I still not see any data coming. If I perform a search I cannot get any data after the upgrade. I have 300+ scripts running every minute. Any ideas?
Using the bundles
directory had been deprecated since at least version 4.0 (possibly 3.4 or earlier), though it did continue to work through 4.1. As of 4.2, you should use etc/apps/<appname>/local
instead of etc/bundles/local
. If you're not prepared to work with apps, you can simply copy the contents of etc/bundles
to etc/apps/bundles
.