topic Re: splunk does not start and has indexing disabled in Getting Data In

splunk does not start and has indexing disabled

yannK — Tue, 04 Dec 2012 01:39:28 GMT

After starting splunk stops immediately with

in splunkd.log

12-03-2012 16:16:26.414 -0800 ERROR IndexProcessor - default index disabled - quit!

and on the command line

Validating databases (splunkd validatedb) failed with code '-1'. Please file a case online at http://www.splunk.com/page/submit_issue

Re: splunk does not start and has indexing disabled

jbsplunk — Tue, 04 Dec 2012 17:43:02 GMT

Prior to the IndexProcessor error, there should be another ERROR that indicates what is wrong with the default index. Can you check your splunkd.log and see if any error's pop up before the disabled message?

Re: splunk does not start and has indexing disabled

jbsplunk — Tue, 04 Dec 2012 18:02:14 GMT

I suspect the issue is the one in the answer I posted here, so take a look at this link:

http://splunk-base.splunk.com/answers/23536/moving-indexes-to-a-new-splunk-server

To find the colliding buckets, see this post:

http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing-conflicts-in-my-index

Re: splunk does not start and has indexing disabled

yannK — Tue, 04 Dec 2012 18:06:28 GMT

in $SPLUNK_HOME/etc/apps/search/local/indexes.conf I see
[main] disabled =1

but it comes back if I remove it.

Re: splunk does not start and has indexing disabled

yannK — Tue, 04 Dec 2012 18:37:40 GMT

Great, I had duplicates bucket ids in my main index : defaultdb\db
I remember now, my backup agent did restore indexes the other day, it seems that multiples indexes were merged into one.