Installation

AWS MarketPlace SPLUNK instance type upgrade

lorezyra
Explorer

I created an instance from the marketplace and later decided to change the instance type.
When I stopped the instance, I know that AWS will delete the ephemeral storage. I never configured SPLUNK to use it.
However, after the instance upgrade (from c5d.2xlarge to c5d.4xlarge), the SPLUNKd service fails to start.

What are the next recommended steps to get SPLUNK running again?
I'm not finding anything useful in /opt/splunk/var/log/splunk/splunkd.log ...

Labels (2)
0 Karma
1 Solution

nickhills
Ultra Champion

if you run /opt/splunk/bin/splunk restart on the CLI does it give you any information about the startup progress. Do you see any errors?

Did you originally run Splunk enable boot-start.

Finally, what version of Splunk, and is it systemd?

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

if you run /opt/splunk/bin/splunk restart on the CLI does it give you any information about the startup progress. Do you see any errors?

Did you originally run Splunk enable boot-start.

Finally, what version of Splunk, and is it systemd?

If my comment helps, please give it a thumbs up!

lorezyra
Explorer

Using MarketPlace SPLUNK Enterprise (core) 7.2.0

Splunk status initially spat error about splunkd not running and hung on killing the child processes. After rebooting the server, splunk status then complained about permission denied for the config files.
Found the config files were set to root:root. So, I chown splunk:splunk -R /opt/splunkand reboot the server again. Then everything came back up!

So, my question now: Why did I need to do all that?

0 Karma

nickhills
Ultra Champion

If you ran Splunk as root by mistake, it may have changed the permissions on the folders, then later when you run it as the Splunk user, it can’t access the files.

It’s easily done.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...