Splunk 10: KV Store MongoDB Upgrade for OpenSSL v3.0 and FIPS 140-3 Compliance

Applicability

Description

To meet FIPS 140-3 compliance requirements and support OpenSSL v3.0, Splunk is updating the MongoDB version used by the KV Store service to version 7.0. MongoDB 7 is a prerequisite for FIPS 140-3 support.

Splunk Enterprise users who cannot upgrade to a version that runs MongoDB version 7.0 should continue to use FIPS 140-2 mode to stay compliant with FIPS.

Key Details:

• Affected Users: This upgrade primarily impacts Splunk Enterprise users who are running a FIPS-compliant version of Splunk Enterprise with MongoDB version 4.2.
• Upgrade Path:
  • • Users must be on MongoDB 4.2 or higher before upgrading to Splunk Enterprise 10.
    • Starting with Splunk 9.4, the install/upgrade process will attempt to sequentially bring MongoDB up to version 7.
    • A fresh installation of Splunk Enterprise 10 will automatically include MongoDB 7.
    • The Splunk Enterprise 10 upgrade will not proceed if MongoDB is not at version 4.2 or above.
• FIPS Compliance:
  • Users unable to upgrade to a Splunk version running MongoDB 7.0 should continue using FIPS 140-2 mode for compliance.

Investigation

Check your KV Store version by running the following command in Splunk:

| rest services/kvstore/version

Common Error Message:

If MongoDB fails to start due to configuration issues related to this upgrade, you might encounter an error message similar to the following in your Splunk logs:

ERROR KVStoreConfigurationProvider [4755 KVStoreConfigurationThread] - Could not start mongo instance. Initialization failed.

Resolution

Upgrade path to Splunk Enterprise 10.0. This upgrade will facilitate the migration to MongoDB 7.0 and enable FIPS 140-3 compliance.

Next Steps:

1. Verify Current MongoDB Version: Run | rest services/kvstore/version in Splunk to confirm your current MongoDB version.
2. Plan Your Upgrade: Ensure your Splunk Enterprise environment is at least on MongoDB 4.2 before initiating the upgrade to Splunk Enterprise 10.0.

Related Links

Preparing to upgrade from 9.x to Splunk Enterprise and Cloud Platform 10.0

Automatically upgrade to KV store server version 7.0