Installation

Why am I getting an error to start a fresh Splunk instance in my mac machine?

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hello Team,

I'm facing an issue to start fresh Splunk instance in my Mac machine.
Any help will be highly appreciated.

 /Applications/Splunk/bin/splunk start

Splunk> Now with more code!

Checking prerequisites...
    Checking http port [8000]: open
    Checking mgmt port [8089]: open
    Checking appserver port [127.0.0.1:8065]: open
    Checking kvstore port [8191]: open
    Checking configuration...  Done.
    Checking critical directories...    Done
    Checking indexes...
homePath='/Applications/Splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'.  If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

Thanks
Kamlesh

Labels (1)
Tags (2)
0 Karma
1 Solution

493669
Super Champion

Add this line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

https://answers.splunk.com/answers/306998/why-am-i-getting-homepathoptsplunkvarlibsplunkaudi.html

View solution in original post

ddrillic
Ultra Champion
0 Karma

493669
Super Champion

Add this line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

https://answers.splunk.com/answers/306998/why-am-i-getting-homepathoptsplunkvarlibsplunkaudi.html

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great.. @493669,

The solution worked. This is something which I face first time.
Well I have to work on the solution implemented and it's side effects on indexed data on machine as mentioned in accepted answer of your provided link.

Again Thanks.

Kamlesh

0 Karma

493669
Super Champion

Yes it's just resolves your issue but it is not a long term solution... As its defeating filesystem locking checks
If you are concerned about your data in any way then it's not recommended to do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable....
Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...