Splunk> recently released version 4.1.4, so of course I had to go and upgrade. Following my own advice from this post on upgrading splunk>, I carefully saved my certificate and private key so that I could replace them when the upgrade overwrote them, downloaded the latest version, and launched the install.
I got one very pleasant surprise, one glitch that turned out to be nothing, and one error for which I found nothing on Google or in the splunk> forums, and that required me to edit a conf file to fix things. I’ll hit the negatives first so that I can finish on a happy note.
False Alarm
The install was fairly standard, requiring only that, as before, I change the service configuration from the option to run as Local System, to using the domain account I have set up to support WMI queries and file access to other domain systems. After the install finished, splunk> errored that it could not start the splunk> web service and that I should check the account credentials and to ensure sufficient rights were granted. Since it is the same service account that I was using before, and I was fairly certain that I remembered the password, I started to worry about things just a little bit. A quick check in services.msc showed that splunkd and splunkweb were both running, hence I call this a false alarm. I did a quick check to make sure I was current on all Windows Updates, and then I rebooted for good measure. That might not have been the best idea I have had though, since after the reboot, I found another issue.
The pigeons ate my breadcrumbs
After the server rebooted, I opened my browser and went to logon on to splunk>. My logon worked fine, but then the web console painted a bright red error bar at the top of the page, that basically stated it could not find the function for goBackOnJobCancelled in BreadCrumb.conf.
Having no idea what that meant, I figured the best bet was to search the error on Google. No joy there. So my second best bet would be to look in the file…I mean, after all, a conf file is just a text file and I might get lucky. There are two breadcrumb.conf files;
one is in %splunkhome\share\splunk\search_mrsparkle\modules.new\nav and the other is in
%splunkhome\share\splunk\search_mrsparkle\modules\nav. Opening them up, they both looked identical until you get to the section on [param:goBackOnJobCancelled] It seems that this function defines what splunk>’s (splunk’s>…what is the possessive of a word spelled with a symbol?) web interface should do when you cancel a job, and it was missing from the second file.
[param:goBackOnJobCancelled]
required = False
label = If True, whenever any job on the current page is cancelled the module will take the user away from the current view. If the module has no 'earlier' links, it will go to the default view in the current app. If the module does have a link to an 'earlier' view then it will go there. At that point it will make an effort to commit outstanding viewstate changes, swap out the (now dead) 'sid' for a corresponding 'q' arg in the permalink, and preserve any other existing querystring arguments.
default = False
values = True,False
I copied that full section from the one to the other, restarted the splunkweb service, and logged back in. Everything was shiny at that point.
Did they finally listen to me?
Well probably not, but you know I have expressed distaste that my enterprise cert kept getting overwritten during upgrades. This time, it did not. Even though I took the precaution of making sure I had my cert and key, this upgrade left my existing data intact, and splunkweb was perfectly happy to use my enterprise certificate without further action required. While popping certs back in is not a huge task, it was an annoying one, and I am very happy that it looks like upgrades going forward will not require that extra step. Yay!
And speaking of pigeons, I went looking for “Poisoning Pigeons in the Park” and found this awesome video from Lucas Martell and company instead. Trained attack pigeons infiltrate a CIA’s agent’s doomsday briefcase. Trust me, you will love this. You can check out the video below, and then see more fun stuff about this project at www.pigeonimpossible.com.
Direct link for RSS and email subscribers…http://www.youtube.com/watch?v=jEjUAnPc2VA
If you found this post useful, please consider following us on twitter. You’ll be the first to learn about new posts, and, rarely, we’ll share a comedic or witty tweet. Of course, you can also leave a comment below (anonymous allowed) to let us know we hooked you up.
You might also enjoy:
