Installation

Error - Warning: cannot create ":\new\path\for\index" when starting Splunk

mookiie2005
Communicator

We are gettiong the below error information when trying to start the splunk service:

win-service: Starting as a Windows service: will run various system checks first...
win-service: Error running pre-flight-checks (_pclose returned 10).
win-service: Here is the output from running pre-flight-checks:
Checking index directory...
Creating: :\new\path\for\index
Warning: cannot create ":\new\path\for\index"
<<<<< EOF (pre-flight-checks)

Anyone received this error before? It is keeping our Splunkd service from starting.

Tags (3)
0 Karma
1 Solution

mookiie2005
Communicator

We actually found the problem to be within the "splunk-launch.conf" file in the Program Files_Splunk_etc. The SPLUNK_DB path was set to SPLUNK_DB=new_path_for_index. This was an invalid location and so caused the error. Not sure how it got set that way as all we did was add a new index. We preformed the same operation on our other indexer and did not encounter any issues. Hope this helps someone else.

View solution in original post

0 Karma

hesron
Engager

chmod -R splunk:splunk /new/path/indexes

0 Karma

Nextbeat
Path Finder

I think you meant chown, but setting permissions for /IndexedData worked for me.

0 Karma

mookiie2005
Communicator

We actually found the problem to be within the "splunk-launch.conf" file in the Program Files_Splunk_etc. The SPLUNK_DB path was set to SPLUNK_DB=new_path_for_index. This was an invalid location and so caused the error. Not sure how it got set that way as all we did was add a new index. We preformed the same operation on our other indexer and did not encounter any issues. Hope this helps someone else.

0 Karma

linu1988
Champion

Check if splunk has access to create index at that path. Check the service running under which account. If its not local give the account full access to that path and if its local account, give the local user full privilege. That will solve your issue.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...