Very belatedly, the so-called "config lock" is $SPLUNK_HOME/var/run/splunk/conf-mutator.pid.
Simple version: 6.2.x+ should only show this behavior when it is correct for it to occur.
This message can occur correctly if you somehow try to run two splunkd programs at once, or if you have a splunk program running which is changing conf files while trying to start splunkd.
In versions before 6.1.3, the checking for running-pid was sloppy and would consider non-splunk programs to be valid owners of the pid.
If you are on such an old version, or if you see this on a new version and believe the behavior is working incorrectly:
Please cat the conf-mutator.pid file and check to see if any process is running with that process ID, to give us a hint about the problem to fix it (the behavior where early 6.1.x considers any program to be a match is the known bug).
Check to see whether you have any splunk or splunkd programs running. If there none around, and the splunk install is not on a shared filesystem, it should be safe to delete it. (6.2.x+ should do this automatically.)
On 6.2.x, for extra credit, please try: splunk cmd pid_check.sh conf-mutator pid_number_from_file . Then echo $? to see the exit code.
If not, it is safe to delete
... View more