All Apps and Add-ons

macOS Sierra 10.12 kills Splunk

hochit
Path Finder

Quite surprised no one reported this. I can't run Splunk anymore even fresh install on macOS Sierra.
Probably Splunk should alert users/engineers not to upgrade macOS before it's fixed.

        Checking indexes...
homePath='/Users/philip/Projects/splunk_demo2/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'.  If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

ChrisG
Splunk Employee
Splunk Employee

There is information--and warnings--about this in the documentation now: Splunk Enterprise does not start due to unusable file system.

0 Karma

mvanorshoven
New Member

Hi Folks,

I did this but I still get the following error message. I suspect I'm doing something really, really dumb. If you could point me in the right direction, that would be great.
alt text

0 Karma

Yorokobi
SplunkTrust
SplunkTrust

You need to tell your macOS firewall to allow connections to :8000. When you first launch Splunk Enterprise you should have been presented with a dialogue box asking to allow or deny access.

0 Karma

malmoore
Splunk Employee
Splunk Employee

The System Requirements page does not list MacOS 10.12 Sierra as a supported operating system for Splunk Enterprise at this time.

You are welcome to install it on that version of MacOS but you do so solely at your own risk. Overriding file system lock check is not the best look.

We will advise on the page I linked when support for MacOS 10.12 is available and supported.

hochit
Path Finder

Got answer from Splunk guy. We can add following line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

hpark9090
New Member

How should I add line to $SPLUNK_HOME/etc/splunk-launch.conf? I have no idea where I can find this conf file.

0 Karma

malmoore
Splunk Employee
Splunk Employee

If the file doesn't exist, you simply need to create it and place the above line in it.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Hmmm. I am surprised to hear about a deployment where that file doesn't exist. Is this merely a scenario of $SPLUNK_HOME not already defined? Did you change that to where Splunk is installed (like /opt/splunk/)?

0 Karma

Dimxxx
New Member

Works on macOS High Sierra 10.13 (17A405)

0 Karma

malmoore
Splunk Employee
Splunk Employee

If you are concerned about your data in any way then you should not not not do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.

There is no support yet for MacOS 10.12. We're working on it, and when it's ready, we'll make sure everybody knows.

If you are doing this as a test, then go right ahead, but you assume all risk for your data otherwise.

michaelmundi
New Member

Hello Malmoore,

Does Splunk now have support for apple 10.12 unified logs ?
Please, advise.

Thanks

0 Karma

woodcock
Esteemed Legend

You should click Accept on your answer.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...