Keyword Ingest module failure

Solved:

I told you it would drive me nuts… :crazy_face:

After some back and forth the over the last week, Downey and I finally identified the culprit. The core properties for the Solr instance that was spinning up with my lab case were wrong. When I started the training lab, I had originally placed the case folder for the lab exercises on my desktop. As part of our troubleshooting, I moved that directory to my “Documents” While poking around the core admin properties section this morning, I noted that the core properties paths for my lab case were as follows:

The instanceDir was correct, but the dataDir wasn’t. I had to go in and modify the attributes of the “core.properties” file for my case to correct that error.

The "core.properties file was located in the “case1_20200131_090630_20200131_090632” sub-directory of my F: drive.

Once I commented out the original code, inserted the correct path and restarted Autopsy - Boom goes the dynamite. Working as expected now.

Once I restarted Autopsy, and checked the core admin properties for Solr again, all was as it should be:

If you run into a communications issue between Autopsy and Solr while attempting to run a keyword search do the following: Start Autopsy, load your case and make sure you can A) connect to Solr via http://localhost:23232/solr and B) that the core properties under the "Core Admin: section on the left side of the Solr control panel are correct. If they aren’t, you might have to correct that in the core.properties file noted above.

image

Cheers,

Ryan