topic Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI? in Getting Data In

Why am I receiving errors when attempting to start Splunk in the Windows CLI?

mjscoggins — Tue, 17 Apr 2018 17:57:39 GMT

I was getting connection refused in the browser (localhost:8000/en-US/app/launcher/home). I was able to start splunk in Windows Services, but received the following Access Denied errors when attempting to start the service in the CLI. Any idea why? I was not logged in as a system admin in case that matters.

C:\Program Files\Splunk\bin>splunk start

Splunk> Like an F-18, bro.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
ERROR - Failed opening "C:\Program Files\Splunk\var\log\splunk\splunkd-utility.log": Access is denied.
Checking configuration... Done.
Failed to open splunk.secret 'C:\Program Files\Splunk\etc\auth\splunk.secret' file. Some passwords will not work. errno=Access is denied.
Unable to read 'C:\Program Files\Splunk\etc\auth\splunk.secret' file.
Checking critical directories... Done
ERROR - Failed opening "C:\Program Files\Splunk\var\log\splunk\splunkd-utility.log": Access is denied.
Checking indexes...
homePath='C:\Program Files\Splunk\var\lib\splunk\audit\db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at splunk.com/page/submit_issue

Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI?

elliotproebstel — Tue, 17 Apr 2018 18:08:05 GMT

That very much reads like a permissions problem. Using the account from which you tried to start Splunk, can you access those files?

C:\Program Files\Splunk\var\log\splunk\splunkd-utility.log
C:\Program Files\Splunk\etc\auth\splunk.secret

Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI?

mjscoggins — Tue, 17 Apr 2018 20:19:14 GMT

I can open the first, but receive access denied on the second when running the CLI with a non-admin account. Ran as Admin and was able to open both. Newbie B-P

Thanks!

Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI?

somesoni2 — Tue, 17 Apr 2018 20:42:24 GMT

When restarting splunk from CLI, did you open the Command prompt as Administrator?

Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI?

ssadanala1 — Tue, 29 Sep 2020 19:07:42 GMT

try setting this

$SPLUNK_HOME/etc/splunk-launch.conf:
OPTIMISTIC_ABOUT_FILE_LOCKING = 1

This error should encounter when installing splunk on mac0s
https://answers.splunk.com/answers/600702/problem-installing-splunk-enterprise-on-macos-1013-1.html

Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI?

mjscoggins — Tue, 17 Apr 2018 23:38:41 GMT

Not at first, but that was the problem. Ran Command prompt as Administrator and no more errors received.

Re: Why am I receiving errors when attempting to start Splunk in the Windows CLI?

elliotproebstel — Wed, 18 Apr 2018 01:55:25 GMT

So that you can close this out, I'll post this as an answer:

That very much reads like a permissions problem. Try running Splunk as an admin-level user. That should give you permissions to read and write the appropriate files.