topic Re: Splunk service won’t start on indexer in Splunk Enterprise

Splunk service won’t start on indexer

Itzmeaj — Wed, 16 Jun 2021 23:59:18 GMT

Hello, I was wondering if anyone else has had this issue before, I just recovered an indexer from a damaged file system. When I attempt to start splunk I get an error about the xml.sax module not found, it appears as this:

splunk start

Traceback (most recent call last):
  File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/common.py", line 16, in <module>
    from xml.sax import saxutils 
ModuleNotFoundError: No module named 'xml.sax'

This is the error from my memory, I will double check it is exactly correct tomorrow.

Re: Splunk service won’t start on indexer

isoutamo — Thu, 17 Jun 2021 06:47:31 GMT

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

Re: Splunk service won’t start on indexer

Itzmeaj — Thu, 17 Jun 2021 22:48:08 GMT

Thank you, I should’ve tried the simplest solution first!