Upgrading to 9.2.5 Generates Error

[dpericaxon]

Description:

We’re attempting to upgrade the Splunk Universal Forwarder from v9.2.4 to v9.2.5 and encounter the following error:

TASK [splunk_universal_forwarder : Check for required restarts] ****************
fatal: [localhost]: FAILED! => {
    "attempts": 5,
    "changed": false,
    "changed_when_result": "The conditional check 'restart_required.status == 200' failed. The error was: error while evaluating conditional (restart_required.status == 200): 'dict object' has no attribute 'status'. 'dict object' has no attribute 'status'"
}
MSG:
GET/services/messages/restart_required?output_mode=jsonadmin********8089NoneNoneNone[200, 404];;; failed with NO RESPONSE and EXCEP_STR as Not supported URL scheme http+unix
PLAY RECAP *********************************************************************
localhost                  : ok=258  changed=95   unreachable=0    failed=1    skipped=162  rescued=0    ignored=0
Wednesday 12 March 2025  01:50:44 +0000 (0:00:31.457)       0:01:41.702 *******
===============================================================================

After this error appears, the pod enters a CrashLoopBackOff state. Does anyone have insights into why this might be happening and how we can resolve it?

[jmeixensperger]

This should be caused by incompatibilities between the requests_unixsocket and requests python libraries being used. The issue was introduced here and affects the following versions:

• 9.4.1
• 9.4.0
• 9.3.3
• 9.2.5
• 9.1.8

The current workaround would be to set ENABLE_TCP_MODE=true on startup. This will cause the management port to be opened on TCP 8089 (default for non-UF), and avoid using a UDS socket.