Hi, I am a bit impressed, this is my first post.
I wanted to upgrade from a splunk 3.4 to 4.1.5 but once done, the browser do an error 500. and say : InternalServerError HTTP500 In handler 'indexes' Parameters beginning with '_' are reserved for EAI's Usage will not allow '_actions'
What is that ? I never created an index starting with underscore.
Hi Mata
It seems that you encountered the deprecated "_actions" index from the old index_server app.
A quick way to fix it is to comment the line starting with : _actions in $SPLUNK_HOME/etc/apps/index_server/default/indexes.conf
If you can't find the line in this specific configuration file, you can use the following command to find it : find $SPLUNK_HOME/etc -name indexes.conf | xargs grep ^_action
then restart splunk.
Hi Mata
It seems that you encountered the deprecated "_actions" index from the old index_server app.
A quick way to fix it is to comment the line starting with : _actions in $SPLUNK_HOME/etc/apps/index_server/default/indexes.conf
If you can't find the line in this specific configuration file, you can use the following command to find it : find $SPLUNK_HOME/etc -name indexes.conf | xargs grep ^_action
then restart splunk.