Quite surprised no one reported this. I can't run Splunk anymore even fresh install on macOS Sierra.
Probably Splunk should alert users/engineers not to upgrade macOS before it's fixed.
Checking indexes... homePath='/Users/philip/Projects/splunk_demo2/var/lib/splunk/audit/db' of index=_audit on unusable filesystem. Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
You need to tell your macOS firewall to allow connections to :8000. When you first launch Splunk Enterprise you should have been presented with a dialogue box asking to allow or deny access.
The System Requirements page does not list MacOS 10.12 Sierra as a supported operating system for Splunk Enterprise at this time.
You are welcome to install it on that version of MacOS but you do so solely at your own risk. Overriding file system lock check is not the best look.
We will advise on the page I linked when support for MacOS 10.12 is available and supported.
Hmmm. I am surprised to hear about a deployment where that file doesn't exist. Is this merely a scenario of
$SPLUNK_HOME not already defined? Did you change that to where Splunk is installed (like
If you are concerned about your data in any way then you should not not not do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.
There is no support yet for MacOS 10.12. We're working on it, and when it's ready, we'll make sure everybody knows.
If you are doing this as a test, then go right ahead, but you assume all risk for your data otherwise.