topic Re: Splunk Light running on Docker throwing unusable filesystem in Splunk Enterprise

Splunk Light running on Docker throwing unusable filesystem

kerberos2001 — Tue, 29 Sep 2020 07:49:45 GMT

Hello,

Today, I tried running Splunk Light into a Docker Container, but at runtime, he thrown the follow message:

shinkeji@06ba197cfe09:/opt/splunk/bin$ sudo ./splunk start
Splunk> See your world. Maybe wish you hadn't.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

The splunk version here is:

Splunk 6.2.3 (build 264376)

How could I fix this? I searched on the anwsers forum, and I have seen some similar problems, but with CIFS and BTRFS. It's the same issue?

Re: Splunk Light running on Docker throwing unusable filesystem

jterry — Mon, 11 Apr 2016 17:18:28 GMT

As a base-line i'd say 1st verify that the splunkd process owner can write to /opt/splunk/var/lib/splunk/audit/db.

Re: Splunk Light running on Docker throwing unusable filesystem

jterry — Tue, 12 Apr 2016 17:39:17 GMT

As a base-line i'd say 1st verify that the splunkd process owner can write to /opt/splunk/var/lib/splunk/audit/db.

Re: Splunk Light running on Docker throwing unusable filesystem

naisanza — Mon, 25 Apr 2016 20:10:38 GMT

You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

Re: Splunk Light running on Docker throwing unusable filesystem

naisanza — Mon, 25 Apr 2016 20:11:26 GMT

You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

Re: Splunk Light running on Docker throwing unusable filesystem

ejharts2015 — Tue, 20 Feb 2018 16:57:40 GMT

Works great. What exactly does this do? I can't find any documentation on that option.