Archive
Highlighted

macOS Sierra 10.12 kills Splunk

Path Finder

Quite surprised no one reported this. I can't run Splunk anymore even fresh install on macOS Sierra.
Probably Splunk should alert users/engineers not to upgrade macOS before it's fixed.

        Checking indexes...
homePath='/Users/philip/Projects/splunk_demo2/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'.  If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
Highlighted

Re: macOS Sierra 10.12 kills Splunk

Path Finder

Got answer from Splunk guy. We can add following line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1
Highlighted

Re: macOS Sierra 10.12 kills Splunk

Esteemed Legend

You should click Accept on your answer.

Highlighted

Re: macOS Sierra 10.12 kills Splunk

Splunk Employee
Splunk Employee

If you are concerned about your data in any way then you should not not not do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.

There is no support yet for MacOS 10.12. We're working on it, and when it's ready, we'll make sure everybody knows.

If you are doing this as a test, then go right ahead, but you assume all risk for your data otherwise.

Highlighted

Re: macOS Sierra 10.12 kills Splunk

New Member

Hello Malmoore,

Does Splunk now have support for apple 10.12 unified logs ?
Please, advise.

Thanks

0 Karma
Highlighted

Re: macOS Sierra 10.12 kills Splunk

New Member

Works on macOS High Sierra 10.13 (17A405)

0 Karma
Highlighted

Re: macOS Sierra 10.12 kills Splunk

New Member

How should I add line to $SPLUNK_HOME/etc/splunk-launch.conf? I have no idea where I can find this conf file.

0 Karma
Highlighted

Re: macOS Sierra 10.12 kills Splunk

Splunk Employee
Splunk Employee

If the file doesn't exist, you simply need to create it and place the above line in it.

0 Karma
Highlighted

Re: macOS Sierra 10.12 kills Splunk

Ultra Champion

Hmmm. I am surprised to hear about a deployment where that file doesn't exist. Is this merely a scenario of $SPLUNK_HOME not already defined? Did you change that to where Splunk is installed (like /opt/splunk/)?

0 Karma
Highlighted

Re: macOS Sierra 10.12 kills Splunk

Splunk Employee
Splunk Employee

The System Requirements page does not list MacOS 10.12 Sierra as a supported operating system for Splunk Enterprise at this time.

You are welcome to install it on that version of MacOS but you do so solely at your own risk. Overriding file system lock check is not the best look.

We will advise on the page I linked when support for MacOS 10.12 is available and supported.