Archive

Problem in Starting SPLUNK

Contributor

I have an application in :

C:\Program Files\Splunk\etc\apps\MyApplication\local

In this path I have indexes.conf and the following lines are written on it

[dg]
coldPath = $SPLUNK_DB/dg/colddb
homePath = $SPLUNK_DB/dg/db
thawedPath = $SPLUNK_DB/dg/thaweddb

I went to C:\Program Files\Splunk\etc\system\local path and created one indexes.conf file in which I wrote the following :

[MyIndex]
coldPath = $SPLUNK_DB/dg/colddb
homePath = $SPLUNK_DB/dg/db
thawedPath = $SPLUNK_DB/dg/thaweddb

After doing this change when I restarted the SPLUNK , I found the following error in the browser :

"The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running."

Pleaes help me out in solving this problem as this comes often and I have to re-install the SPLUNK from the scratch ( this is not a solution as I have to configure everything ..)

Please Please help me out and get me some solutions for this problem

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You can't use the same homePath, coldPath or thawedPath for two different indexes. Remove one or the other and try starting Splunk again.

View solution in original post

Splunk Employee
Splunk Employee

You can't use the same homePath, coldPath or thawedPath for two different indexes. Remove one or the other and try starting Splunk again.

View solution in original post

SplunkTrust
SplunkTrust

Have you made sure Splunkd is actually running?

Another problem I see is that you are creating two different indexes (MyIndex and dg) that use the same location. If the dg index is App specific, I wouldn't put it in etc\system\local. If you still want to use the "MyIndex" index, it needs to be in a different location than $SPLUNK_DB\dg\db. Also, make sure your slashes are the correct way "\" for windows.

Champion

...and that's one of the more descriptive error messages...

0 Karma

Legend

...which is exactly what everyone here's been saying.

Contributor

This is splunkd.log error :


12-13-2012 17:33:31.888 +0530 ERROR loader - Problem parsing indexes.conf: index=dg Path=C:\Program Files\Splunk\var\lib\splunk/dg/db given as value of param=homePath collides with value of param2=homePath of index2=greatinvention).
12-13-2012 17:33:31.888 +0530 ERROR loader - Checking indexes...
12-13-2012 17:33:31.888 +0530 ERROR loader - Validating databases (splunkd validatedb) failed with code '1'.

0 Karma

SplunkTrust
SplunkTrust

Look in the $SPLUNK_HOME/var/log/splunk/splunkd.log and $SPLUNK_HOME/var/log/splunk/web_service.log files. What errors do you see at the times that you attempt the connection? Have you confirmed that both the splunkweb and splunkd services are running?

Contributor

Thanks for this mistakenly I was trying to create both the indexes in the same location but dg index was working fine and now I hvng removed indexes.conf file from system local directories also but still getting the same error as mentioned above in my browser . I am not able to login to my splunk. When I tried creating two indexes in the same location is there any entry written to any config file because of that it is not allowing me to login plz help otherwise I hvng to reinstall splunk which I don't prefer at all plz help

0 Karma