- Splunk Answers
- :
- Splunk Administration
- :
- Installation
- :
- Re: Splunk 6.1.1 Upgrade, Distributed Search Key P...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting distributed search key error when trying to upgrade to Splunk 6.1.1.
Has anyone experienced this error? I'm using a single deployment not a distributed one.
Since the file was missing, I generated a generic distsearch.conf file and placed it under /opt/splunk/etc/system/local and still get the same error when I try and start splunk.
Migrating to:
VERSION=6.1.1
BUILD=207789
PRODUCT=splunk
PLATFORM=Linux-i386
********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********
Unable to generate distributed search keys.
An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may be corrupt or may require a restart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Following worked for me:
$ cp /opt/splunk/etc/system/default/distsearch.conf /opt/splunk/etc/system/local/distsearch.conf
$ chmod 640 /opt/splunk/etc/system/local/distsearch.conf
$ cd /opt/splunk/etc/auth/distServerKeys
$ mv private.pem private.pem_old
$ mv trusted.pem trusted.pem_old
$ splunk restart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm running this OS.
Linux hostname 3.2.0-4-686-pae #1 SMP Debian 3.2.57-3 i686 GNU/Linux
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
WoW quick update, backed up all the configurations, indexes and deleted everything. Installed it from scratch and still get this error.
This appears to be your first time running this version of Splunk.
.........
Generating RSA private key, 1024 bit long modulus
........++++++
..............................................++++++
e is 65537 (0x10001)
writing RSA key
Unable to generate distributed search keys.
An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may require a restart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still have this problem, it did not go away with 6.1.2.
Migrating to:
VERSION=6.1.2
BUILD=213098
PRODUCT=splunk
PLATFORM=Linux-i386
Unable to generate distributed search keys.
An error occurred: no 'tokenExchKeys' stanza exists in distsearch.conf. Your configuration may be corrupt or may require a restart.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
