Deployment Architecture

Splunk Won't Start: Validating DB code -2

marquiselee
Path Finder

Spunk was operating extremely slow this morning. I then restarted it via the web console however it stalled in that process. I looked the the services.msc and saw that the splunkd service was not running. I tried to start it from there with no luck (error: The Splunkd service on local computer started and then stopped...) When I try to start manually from command line I get the following.

"C:\Program Files\Splunk\bin>splunk start

Splunk> Finding your faults, just like mom.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking configuration... Done.
Checking index directory...
Couldn't open log file configuration "C:\Program Files\Splunk\etc\log.cfg": The
operation completed successfully.
Error loading logging config file
Validating databases (splunkd validatedb) failed with code '-2'. Please file a
case online at http://www.splunk.com/page/submit_issue

C:\Program Files\Splunk\bin>"

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Can you try to shutdown all the splunk processes. Then try a clean start.

If it fails again, please collect a diag with splunk diag and create a support ticket.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

Can you try to shutdown all the splunk processes. Then try a clean start.

If it fails again, please collect a diag with splunk diag and create a support ticket.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...