While upgarding to the lastest version i get below error while is start the service
Process: 25918 ExecStart=/opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt (code=exited, status=2)
splunkd.service: control process exited, code=exited status=2
This is what the splunkd daemon error says:
An error occurred: Failed to run splunkd rest:
stderr:splunkd: /opt/splunk/src/util/HttpClientRequest.cpp:1760: void HttpClientTransaction::_handleProxyConnect(): Assertion `_poolp->hasSslContext()' failed.
Dying on signal #6 (si_code=-6), sent by PID 26389 (UID 1002). Attempting to clean up pidfile
Anyone else seen this error before?
This is because you have a lingering Splunk process that is preventing your upgraded version from starting.
Manually stop all Splunk services (/opt/splunk/bin/splunk stop and/or systemctl splunk stop).
Then search for any lingering processes:
ps -ef |grep -i splunk
If any are found, terminate them manually:
kill -9
Then restart Splunk.
Sorry to say but this seems like a situation where the response seems been there , done that, kind of case :).
I have splunk installed as a service and service splunk stop works and all the process stops at once the output for ps -ef | grep -i splunk is none.
I am more keen to know more about this article here which describe my situation
https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/RunSplunkassystemdservice#Upgrade_considera...
Does anyone faced or elaborate on this section of the article.
The "service" command is just a wrapper for init.d.
The init.d vs systemd topic is a long running topic of frustration/confusion for many users and is discussed in countless threads on this forum.
Also, this should help you configure Splunk to run on either flavor, based on your preference.
From your output, I can see that Splunk is running under systemd, and your "service" call is routing the command back to systemctl (which is expected behavior in Linux).
BTW...this can happen for a number of reasons, but the most common I see is one version is configured to run under init.d and another under systemd.
I don't think the latest version 8 is configured as init.d, coz my current version 7 is configured as systemd.
But thanks for the comment.
Make sure all of the files in /opt/splunk are owned by the user running Splunk. Sign on as root and run chown -R splunk:splunk /opt/splunk
.
Also, make sure to follow the upgrade instructions for all of the interim releases.
Done that 🙂