This is the error that I'm getting when I try to open Splunk.....
"Splunk> Now with more code!
Checking http port : open
Checking mgmt port : open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port : open
Checking configuration... Done.
Checking critical directories... Done
homePath='/Applications/Splunk/var/lib/splunk/audit/db' of index=audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submitissue"
What am I doing wrong?
This is an indication that you may have Splunk deployed on top of an unsupported filesystem that does not implement required file locking mechanism. Setting that attribute in splunk-launch.conf is overriding our internal file locking test during startup.
$SPLUNK_HOME/etc/splunk-launch.conf: OPTIMISTIC_ABOUT_FILE_LOCKING = 1
Just do as @pgrab said. Open the file and splunklaunch.conf located in $SPLUNK_HOME/etc/ and put the
OPTIMISTIC_ABOUT_FILE_LOCKING = 1
In the end of that file. $Splunk_home is the directory where Splunk is installed
No.. You will have the same issue.
$SPLUNK_HOME is your variable home path. On your Mac,
$SPLUNK_HOME will represent
He is telling you to go to where Splunk is installed, then go to the
/Applications/splunk/etc/splunk-launch.conf file and add that
OPTIMISITC_ABOUT_FILE_LOCAKING =1 attribute and save the file. This will fix your issue, I'm on a Mac too
I can't even find the $SPLUNK _HOME file, which means that I can't find splunk-launch.conf. I went to the finder and looked everywhere in all of the Splunk files.
I'm using a MAC OS. Should I just uninstall and start over?
$SPLUNK_HOME is the directory where Splunk is installed. It is often referred to as this because this varies by installation OS, installation method, and package that's being installed. In your case
/Applications/Splunk is where you've installed Splunk so you're looking to edit
Now you should note that while making this change, you can get Splunk to run on MacOS High Sierra, and it may even work OK for some test cases & experimentation, Splunk, Inc. does not support this setup currently, and you'll want to proceed with caution. See the more official note on this question: https://answers.splunk.com/answering/593002/view.html
I'm on a Mac OS and I'm trying to download Splunk on my laptop. I'm getting the above error and I don't know what I'm supposed to do. Is there a setting or something that I'm missing?