Hi. We just upgraded from 4.2.2 to 4.3.3.
We are using search head pooling, so we followed the specific instructions for dealing with that situation (ie, unpool, upgrade each head, repool).
Now, it seems that Views and Saved Searches by some of our users are showing up as having no owner.
I checked and it looks to me like the user's directory exists in $SHARED/etc/users and (as you might expect) not in $SPLUNK_HOME/etc/users
Has anyone else run into this? I did make a backup of everything before the upgrade, so if the upgrade clobbered some critical files I'm not aware of, I could replace them, I just don't even know where to start!
We run Splunk pooled. Typically for an upgrade I do the following:
Stop Splunk
Unpool
Backup the pooled etc/users and etc/apps
Copy etc/users to local $SPLUNK_HOME/etc/users
Copy etc/apps to local $SPLUNK_HOME/etc/apps
Upgrade Splunk
Start Splunk
Stop Splunk
Copy $SPLUNK_HOME/etc/users back the pooled location
Copy $SPLUNK_HOME/etc/apps back to the pooled location
Enable Pooling
Start Splunk
I only do the copy (both directions) for one server since it is pooled.
We run Splunk pooled. Typically for an upgrade I do the following:
Stop Splunk
Unpool
Backup the pooled etc/users and etc/apps
Copy etc/users to local $SPLUNK_HOME/etc/users
Copy etc/apps to local $SPLUNK_HOME/etc/apps
Upgrade Splunk
Start Splunk
Stop Splunk
Copy $SPLUNK_HOME/etc/users back the pooled location
Copy $SPLUNK_HOME/etc/apps back to the pooled location
Enable Pooling
Start Splunk
I only do the copy (both directions) for one server since it is pooled.
Thanks. I thought to copy pooled/etc/apps back pre-upgrade but not pooled/etc/users. Looks like i have to roll back on one server and re-upgrade in order for all the apps to see their rightful owners.