Hello Team,
I'm facing an issue to start fresh Splunk instance in my Mac machine.
Any help will be highly appreciated.
/Applications/Splunk/bin/splunk start
Splunk> Now with more code!
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
homePath='/Applications/Splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
Thanks
Kamlesh
Add this line to $SPLUNK_HOME/etc/splunk-launch.conf
OPTIMISTIC_ABOUT_FILE_LOCKING = 1
https://answers.splunk.com/answers/306998/why-am-i-getting-homepathoptsplunkvarlibsplunkaudi.html
Identical issue at Error while validating databases
Add this line to $SPLUNK_HOME/etc/splunk-launch.conf
OPTIMISTIC_ABOUT_FILE_LOCKING = 1
https://answers.splunk.com/answers/306998/why-am-i-getting-homepathoptsplunkvarlibsplunkaudi.html
Great.. @493669,
The solution worked. This is something which I face first time.
Well I have to work on the solution implemented and it's side effects on indexed data on machine as mentioned in accepted answer of your provided link.
Again Thanks.
Kamlesh
Yes it's just resolves your issue but it is not a long term solution... As its defeating filesystem locking checks
If you are concerned about your data in any way then it's not recommended to do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable....
Thanks.