Splunk Starting Issues - Splunk Enterprise Troubleshooting Use Case - 25

14.06.24 07:23 PM - By Murugan

Splunk Starting Issues:

Issue:

Splunk Enterprise does not start due to unusable filesystem.

Root cause:

Splunk software does not know how to write to your machine's filesystem.

homePath='/opt/splunk/var/lib/splunk/audit/db' of index="_audit" on unusable filesystem.

Validating databases (splunkd validatedb) failed with code '1'.

Solution:

Adding "OPTIMISTIC_ABOUT_FILE_LOCKING" will Temporarily bypass filesystem checks.

File name: $SPLUNK_HOME/etc/splunk-launch.conf

[default]
OPTIMISTIC_ABOUT_FILE_LOCKING=1