topic Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue in Getting Data In

Why is there a Problem parsing indexes.conf and throwing an error?

perlish — Mon, 14 Aug 2023 17:02:21 GMT

Hi, i restall the splunk
Then i copied the old /splunk/var/ to the new /opt/splunk/
But when i start splunk,i met this error

Problem parsing indexes.conf: default index disabled - quit!
Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

And then i copied the all old indexes.conf to overwrite the new indexes.conf

But still this error

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

hexx — Thu, 09 Aug 2012 04:07:55 GMT

This is usually caused by the improper use of an inline comment in indexes.conf. For example:

homePath = /data/sandwich_security/db. # Gotta keep an eye on those sandwiches!

This can prevent splunkd from parsing your indexes.conf.

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

snickered — Mon, 07 Jan 2013 13:02:48 GMT

I just ran into this. My $SPLUNK_HOME/etc/system/local/indexes.conf had:

[main] disabled = 1

I changed that over to 0 and I was good. I suspect I mucked things up when I ran splunk as root then tried to reboot at which time it tried to start as user splunk. I had to fix several file permission issues. I found out everything (so far) was fixed with 'chmod -R splunk $SPLUNK_HOME'.

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

yannK — Mon, 07 Jan 2013 16:53:48 GMT

usually, this is because splunk detected a duplicate bucket id in your main index.
see http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing-conflicts-in-my-index

to fix :

check the logs $SPLUNK_HOME/var/log/splunk/splunkd.log to find the culprit buckets.
identify them and fix them (increment the bucket id should be enough)
edit the indexes.conf to re-enable the main index.
restart splunk.
it it fails restart the procedure.

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

jsven7 — Sat, 17 Feb 2018 15:16:55 GMT

I don't even have an splunkd.log in "splunk" folder.

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

yashjain — Mon, 16 Apr 2018 21:43:34 GMT

Same. I don't even have splunkd.log in my 'splunk' folder.

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with c

kubermensch — Mon, 14 Aug 2023 09:18:10 GMT

Hello @hexx ,

Apologies for following up on this 11 years old thread...

This is usually caused by the improper use of an inline comment in indexes.conf.

I couldn't find anything in official documentation that inline comments are disallowed in indexes.conf. But maybe i just didn't look at the right place.

Could you confirm that inline comments are disallowed in indexes.conf please?

(and if its allowed in other config files generally or a specific list of files?)

PS: i checked v9.1.0 Indexes.conf and v9.1.0 Inputs.conf

Cheers,

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with c

kubermensch — Thu, 24 Aug 2023 05:31:06 GMT

Its described here (thanks to my colleague at Amadeus)

https://docs.splunk.com/Documentation/Splunk/9.1.0/Admin/Howtoeditaconfigurationfile#Where_not_to_put_your_comments

I'd be interested to know why this weird behaviour was chosen.

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with c

isoutamo — Thu, 24 Aug 2023 08:03:57 GMT

Probably it's not chosen, it's just "lazy" coding for input checking and extractions.
You could create an idea for fix this on ideas.splunk.com.

Add:

I actually create a new idea for it https://ideas.splunk.com/ideas/EID-I-2035