I’m running Splunk 6.4.2 on RedHat Enterprise Linux 6.8. I have a 10GB license and usually use up around 4GB per day. Certain days will go up to around 7GB, but I haven’t exceeded my license in a long time (see my 30-day license usage screenshot). I ran a 'yum update' to apply a kernel patch and some others to all my Splunk indexers and search heads on Nov. 2 and rebooted the servers. However, now Splunk thinks all my indexed data applies to just one day (the current day) and it says I’ve indexed 32.332GB for today. As you can see from the 30-day usage report above, the usage data stops at Nov. 2, which is the day I rebooted. In the 9 days since then, I would’ve indexed around 30+GB, so that backs up my assumption that Splunk is globbing all my indexing since Nov. 2 into one day’s license allowance. Here's "today's" license usage report: Has anyone ever run into this problem? The Splunk licensing alert says I need to correct this by midnight to avoid violation. The date on my servers is correct, and I definitely have not been saving up over a week's worth of logs to index all on today. Thanks, Ray ... View more

I've installed Splunk Universal Forwarder 4.2.1 on Solaris 10 (x86 and SPARC), but I can't get them to run as a non-root user. I followed the instructions at http://www.splunk.com/base/Documentation/latest/installation/RunSplunkasadifferentornon-rootuser to chown $SPLUNK_HOME and set the splunk user privs, but I get the following errors when trying to run Splunk as the splunk user: $ id uid=40104(splunk) gid=144(splunk) $ /opt/splunkforwarder/bin/splunk start --accept-license This appears to be your first time running this version of Splunk. terminate called after throwing an instance of 'ConfPathHasNoWriter' what(): Could not find writer for: /nobody/system/server/sslConfig [1] [/opt/splunkforwarder/etc] Abort - core dumped Splunk> Finding your faults, just like mom. Checking prerequisites... Checking mgmt port [8089]: open Creating: /opt/splunkforwarder/var/lib/splunk Creating: /opt/splunkforwarder/var/lib/splunk/appserver/i18n Creating: /opt/splunkforwarder/var/lib/splunk/appserver/modules/static/css Creating: /opt/splunkforwarder/var/run/splunk Creating: /opt/splunkforwarder/var/run/splunk/upload Creating: /opt/splunkforwarder/var/spool/splunk Creating: /opt/splunkforwarder/var/spool/dirmoncache Creating: /opt/splunkforwarder/var/lib/splunk/authDb Creating: /opt/splunkforwarder/var/lib/splunk/hashDb New certs have been generated in '/opt/splunkforwarder/etc/auth'. terminate called after throwing an instance of 'ConfPathHasNoWriter' what(): Could not find writer for: /nobody/system/server/sslConfig [1] [/opt/splunkforwarder/etc] ERROR: pid 28316 terminated with signal 6 (core dumped) Checking conf files for typos... terminate called after throwing an instance of 'ConfPathHasNoWriter' what(): Could not find writer for: /nobody/system/server/sslConfig [1] [/opt/splunkforwarder/etc] ERROR: pid 28317 terminated with signal 6 (core dumped) There might be typos in your conf files. For more information, run 'splunk btool check --debug' All preliminary checks passed. Starting splunk server daemon (splunkd)... terminate called after throwing an instance of 'ConfPathHasNoWriter' what(): Could not find writer for: /nobody/system/server/general [1] [/opt/splunkforwarder/etc] ERROR: pid 28325 terminated with signal 6 (core dumped) Timed out waiting for splunkd to start. Any ideas? I didn't have this problem when trying on an Ubuntu server with Splunk Universal Forwarder 4.2. Thanks, Ray ... View more