topic Re: Problem in Starting SPLUNK in Getting Data In

Problem in Starting SPLUNK

abhayneilam — Thu, 13 Dec 2012 13:23:12 GMT

I have an application in :

C:\Program Files\Splunk\etc\apps\MyApplication\local

In this path I have indexes.conf and the following lines are written on it

[dg] coldPath = $SPLUNK_DB/dg/colddb homePath = $SPLUNK_DB/dg/db thawedPath = $SPLUNK_DB/dg/thaweddb

I went to C:\Program Files\Splunk\etc\system\local path and created one indexes.conf file in which I wrote the following :

[MyIndex] coldPath = $SPLUNK_DB/dg/colddb homePath = $SPLUNK_DB/dg/db thawedPath = $SPLUNK_DB/dg/thaweddb

After doing this change when I restarted the SPLUNK , I found the following error in the browser :

"The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

Pleaes help me out in solving this problem as this comes often and I have to re-install the SPLUNK from the scratch ( this is not a solution as I have to configure everything ..)

Please Please help me out and get me some solutions for this problem

Re: Problem in Starting SPLUNK

alacercogitatus — Thu, 13 Dec 2012 13:55:14 GMT

Have you made sure Splunkd is actually running?

Another problem I see is that you are creating two different indexes (MyIndex and dg) that use the same location. If the dg index is App specific, I wouldn't put it in etc\system\local. If you still want to use the "MyIndex" index, it needs to be in a different location than $SPLUNK_DB\dg\db. Also, make sure your slashes are the correct way "\" for windows.

Re: Problem in Starting SPLUNK

abhayneilam — Thu, 13 Dec 2012 18:14:00 GMT

Thanks for this mistakenly I was trying to create both the indexes in the same location but dg index was working fine and now I hvng removed indexes.conf file from system local directories also but still getting the same error as mentioned above in my browser . I am not able to login to my splunk. When I tried creating two indexes in the same location is there any entry written to any config file because of that it is not allowing me to login plz help otherwise I hvng to reinstall splunk which I don't prefer at all plz help

Re: Problem in Starting SPLUNK

sowings — Thu, 13 Dec 2012 18:37:31 GMT

You can't use the same homePath, coldPath or thawedPath for two different indexes. Remove one or the other and try starting Splunk again.

Re: Problem in Starting SPLUNK

alacercogitatus — Thu, 13 Dec 2012 19:02:51 GMT

Look in the $SPLUNK_HOME/var/log/splunk/splunkd.log and $SPLUNK_HOME/var/log/splunk/web_service.log files. What errors do you see at the times that you attempt the connection? Have you confirmed that both the splunkweb and splunkd services are running?

Re: Problem in Starting SPLUNK

abhayneilam — Fri, 14 Dec 2012 03:45:35 GMT

This is splunkd.log error :

12-13-2012 17:33:31.888 +0530 ERROR loader - Problem parsing indexes.conf: index=dg Path=C:\Program Files\Splunk\var\lib\splunk/dg/db given as value of param=homePath collides with value of param2=homePath of index2=greatinvention).
12-13-2012 17:33:31.888 +0530 ERROR loader - Checking indexes...
12-13-2012 17:33:31.888 +0530 ERROR loader - Validating databases (splunkd validatedb) failed with code '1'.

Re: Problem in Starting SPLUNK

Ayn — Fri, 14 Dec 2012 08:42:33 GMT

...which is exactly what everyone here's been saying.

Re: Problem in Starting SPLUNK

Drainy — Fri, 14 Dec 2012 09:01:04 GMT

...and that's one of the more descriptive error messages...