Getting Data In
Highlighted

Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

Communicator

Hi, i restall the splunk
Then i copied the old /splunk/var/ to the new /opt/splunk/
But when i start splunk,i met this error

Problem parsing indexes.conf: default index disabled - quit!
Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

And then i copied the all old indexes.conf to overwrite the new indexes.conf

But still this error

Tags (1)
Highlighted

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

Splunk Employee
Splunk Employee

This is usually caused by the improper use of an inline comment in indexes.conf. For example:

homePath = /data/sandwich_security/db. # Gotta keep an eye on those sandwiches!

This can prevent splunkd from parsing your indexes.conf.

0 Karma
Highlighted

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

Path Finder

I just ran into this. My $SPLUNK_HOME/etc/system/local/indexes.conf had:

[main] disabled = 1

I changed that over to 0 and I was good. I suspect I mucked things up when I ran splunk as root then tried to reboot at which time it tried to start as user splunk. I had to fix several file permission issues. I found out everything (so far) was fixed with 'chmod -R splunk $SPLUNK_HOME'.

Highlighted

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

Splunk Employee
Splunk Employee

usually, this is because splunk detected a duplicate bucket id in your main index.
see http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing...

to fix :

  • check the logs $SPLUNK_HOME/var/log/splunk/splunkd.log to find the culprit buckets.
  • identify them and fix them (increment the bucket id should be enough)
  • edit the indexes.conf to re-enable the main index.
  • restart splunk.
  • it it fails restart the procedure.
Highlighted

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

Path Finder

I don't even have an splunkd.log in "splunk" folder.

0 Karma
Highlighted

Re: Problem parsing indexes.conf: default index disabled - quit! Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue

New Member

Same. I don't even have splunkd.log in my 'splunk' folder.

0 Karma