Archive
Highlighted

Error loading logging conf file - can't start Splunk Enterprise Server

Splunk Employee
Splunk Employee

Not able to start Splunk.

When running "./splunk start" from the command line, Splunk Enterprise Server fails to start with the following error message:

Error loading logging conf file='/opt/splunk/etc/log.cfg'; runContext=splunkd

Tags (2)
Highlighted

Re: Error loading logging conf file - can't start Splunk Enterprise Server

Splunk Employee
Splunk Employee

As per error message, root cause of the issue is related to log.cfg file in located the /opt/splunk/etc/ directory.

Checked in the splunkd.log file in $SPLUNK_HOME/var/log/splunk and observed the following message in it:

WARN Logger - /opt/splunk/etc/log.cfg:11: Parse error at "TailingProcessork....

It was found that the category.TailingProcessor parameter name was not spelled correctly. After updating the parameter name in the log.cfg file, user was able to start Splunk Server successfully.

View solution in original post