Getting Data In

Problem in Starting SPLUNK

abhayneilam
Contributor

I have an application in :

C:\Program Files\Splunk\etc\apps\MyApplication\local

In this path I have indexes.conf and the following lines are written on it

[dg]
coldPath = $SPLUNK_DB/dg/colddb
homePath = $SPLUNK_DB/dg/db
thawedPath = $SPLUNK_DB/dg/thaweddb

I went to C:\Program Files\Splunk\etc\system\local path and created one indexes.conf file in which I wrote the following :

[MyIndex]
coldPath = $SPLUNK_DB/dg/colddb
homePath = $SPLUNK_DB/dg/db
thawedPath = $SPLUNK_DB/dg/thaweddb

After doing this change when I restarted the SPLUNK , I found the following error in the browser :

"The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

Pleaes help me out in solving this problem as this comes often and I have to re-install the SPLUNK from the scratch ( this is not a solution as I have to configure everything ..)

Please Please help me out and get me some solutions for this problem

0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

You can't use the same homePath, coldPath or thawedPath for two different indexes. Remove one or the other and try starting Splunk again.

View solution in original post

sowings
Splunk Employee
Splunk Employee

You can't use the same homePath, coldPath or thawedPath for two different indexes. Remove one or the other and try starting Splunk again.

alacercogitatus
SplunkTrust
SplunkTrust

Have you made sure Splunkd is actually running?

Another problem I see is that you are creating two different indexes (MyIndex and dg) that use the same location. If the dg index is App specific, I wouldn't put it in etc\system\local. If you still want to use the "MyIndex" index, it needs to be in a different location than $SPLUNK_DB\dg\db. Also, make sure your slashes are the correct way "\" for windows.

Drainy
Champion

...and that's one of the more descriptive error messages...

0 Karma

Ayn
Legend

...which is exactly what everyone here's been saying.

abhayneilam
Contributor

This is splunkd.log error :


12-13-2012 17:33:31.888 +0530 ERROR loader - Problem parsing indexes.conf: index=dg Path=C:\Program Files\Splunk\var\lib\splunk/dg/db given as value of param=homePath collides with value of param2=homePath of index2=greatinvention).
12-13-2012 17:33:31.888 +0530 ERROR loader - Checking indexes...
12-13-2012 17:33:31.888 +0530 ERROR loader - Validating databases (splunkd validatedb) failed with code '1'.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Look in the $SPLUNK_HOME/var/log/splunk/splunkd.log and $SPLUNK_HOME/var/log/splunk/web_service.log files. What errors do you see at the times that you attempt the connection? Have you confirmed that both the splunkweb and splunkd services are running?

abhayneilam
Contributor

Thanks for this mistakenly I was trying to create both the indexes in the same location but dg index was working fine and now I hvng removed indexes.conf file from system local directories also but still getting the same error as mentioned above in my browser . I am not able to login to my splunk. When I tried creating two indexes in the same location is there any entry written to any config file because of that it is not allowing me to login plz help otherwise I hvng to reinstall splunk which I don't prefer at all plz help

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...