We are in the process of upgrading ES to 4.5.3 and am receiving the error below after clicking to Exclude the ES TA's during the setup process.
Failed to start stage: [HTTP 400] Bad Request; [{'code': None, 'type': 'ERROR', 'text': "Collection 'es_installer' cannot be used as it is disabled."}]"
Has anyone see this error or perhaps can point me in a direction to re enable the es_installer collection.
Thanks in advance.
Splunk Core ver 6.4.8
Find the problem in the Enterprise Security app under the collections.conf. For some reason we had a local copy with that collection disabled. Re enabled and all is working.
Find the problem in the Enterprise Security app under the collections.conf. For some reason we had a local copy with that collection disabled. Re enabled and all is working.