Getting Data In

Splunk does not start after installation on Windows 7 64 bit?

ebissao
Engager

I have just installed Splunk Enterprise on Windows 7 enterprise (64 bit operating system).
After finishing the install process using the default option, the splunk does not start. I could not figure out the reason and the fix.
Can someone help me out please?

Below I have pasted the log file for details.

06-25-2015 12:50:10.314 +0200 INFO  loader - win-service: Starting as a Windows service: will run various system checks first...
06-25-2015 12:50:10.314 +0200 INFO  loader - win-service: Splunk starting as a local administrator
06-25-2015 12:50:10.314 +0200 INFO  loader - Automatic migration of modular inputs
06-25-2015 12:50:21.656 +0200 INFO  loader - win-service: Command pre-flight-checks ran successfully.
06-25-2015 12:50:24.105 +0200 INFO  loader - win-service: Command check-xml-files ran successfully.
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - Will generate GUID, as none found on this server.
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - My newly generated GUID is 087B6B21-F296-4205-AACF-7B65A81653A6
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - My server name is "MW7GVREL3MPVGT".
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - Found no site defined in server.conf
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - Host name option is "".
06-25-2015 12:50:24.120 +0200 INFO  ServerConfig - My hostname is "MW7GVREL3MPVGT".
06-25-2015 12:50:24.136 +0200 INFO  ServerConfig - Setting HTTP server compression state=on
06-25-2015 12:50:24.136 +0200 INFO  ServerConfig - Setting HTTP client compression state=0 (false)
06-25-2015 12:50:24.136 +0200 INFO  ServerConfig - Default output queue for file-based input: parsingQueue.
06-25-2015 12:50:24.152 +0200 INFO  loader - Splunkd starting (build 264376).
06-25-2015 12:50:24.152 +0200 INFO  loader - System info: Windows, MW7GVREL3MPVGT, 1, 6, x64.
06-25-2015 12:50:24.152 +0200 INFO  loader - Detected 4 (virtual) CPUs, 2 CPU cores, and 3977MB RAM
06-25-2015 12:50:24.152 +0200 INFO  loader - Maximum number of threads (approximate): 1988
06-25-2015 12:50:24.152 +0200 INFO  loader - Arguments are: "-p" "8089"
06-25-2015 12:50:24.152 +0200 INFO  loader - Getting configuration data from: C:\Program Files\Splunk\etc\myinstall\splunkd.xml
06-25-2015 12:50:24.152 +0200 INFO  loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to C:\Program Files\Splunk\etc\modules
06-25-2015 12:50:24.152 +0200 INFO  loader - loading modules from C:\Program Files\Splunk\etc\modules
06-25-2015 12:50:24.152 +0200 INFO  loader - Writing out composite configuration file: C:\Program Files\Splunk\var\run\splunk\composite.xml
06-25-2015 12:50:24.152 +0200 INFO  BundlesSetup - Setup stats for C:\Program Files\Splunk\etc: wallclock_elapsed_msec=16, cpu_time_used=0.0156001, shared_services_generation=1, shared_services_population=1
06-25-2015 12:50:24.198 +0200 INFO  loader - Setting SSL configuration.
06-25-2015 12:50:24.198 +0200 INFO  loader - Server supporting SSL versions SSL3,TLS1.0,TLS1.1,TLS1.2
06-25-2015 12:50:24.198 +0200 INFO  loader - Using cipher suite TLSv1+HIGH:@STRENGTH
06-25-2015 12:50:24.198 +0200 INFO  loader - ECDH curve not configured
06-25-2015 12:50:24.401 +0200 INFO  LicenseMgr - Initing LicenseMgr
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - serverName=MW7GVREL3MPVGT guid=087B6B21-F296-4205-AACF-7B65A81653A6
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - connection_timeout=30
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - send_timeout=30
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - receive_timeout=30
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - squash_threshold=2000
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - strict_pool_quota=1
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - key=pool_suggestion not found in licenser stanza of server.conf, defaulting=''
06-25-2015 12:50:24.401 +0200 INFO  LicenseMgr - Initing LicenseMgr runContext_splunkd=true
06-25-2015 12:50:24.401 +0200 INFO  LMStackMgr - closing stack mgr
06-25-2015 12:50:24.401 +0200 INFO  LMSlaveInfo - all slaves cleared
06-25-2015 12:50:24.401 +0200 INFO  LMStack - Added type=download-trial license, from file=enttrial.lic, to stack=download-trial of group=Trial
06-25-2015 12:50:24.401 +0200 INFO  LMStackMgr - created stack='download-trial'
06-25-2015 12:50:24.401 +0200 INFO  LMStackMgr - have to auto-set active stack group='Trial' reason='invalid/missing group id' gidStr='' oldGid=Invalid
06-25-2015 12:50:24.401 +0200 INFO  LMConfig - created default pool=auto_generated_pool_download-trial for stack=download-trial
06-25-2015 12:50:24.401 +0200 INFO  LMStackMgr - added default pool=auto_generated_pool_download-trial for stack=download-trial
06-25-2015 12:50:24.417 +0200 INFO  LMConfig - created default pool=auto_generated_pool_forwarder for stack=forwarder
06-25-2015 12:50:24.417 +0200 INFO  LMStackMgr - added default pool=auto_generated_pool_forwarder for stack=forwarder
06-25-2015 12:50:24.417 +0200 INFO  LMConfig - created default pool=auto_generated_pool_free for stack=free
06-25-2015 12:50:24.417 +0200 INFO  LMStackMgr - added default pool=auto_generated_pool_free for stack=free
06-25-2015 12:50:24.417 +0200 INFO  ServerRoles - Declared role=license_master.
06-25-2015 12:50:24.417 +0200 INFO  LMStackMgr - init completed [087B6B21-F296-4205-AACF-7B65A81653A6,Trial,runContext_splunkd=true]
06-25-2015 12:50:24.417 +0200 INFO  LicenseMgr - StackMgr init complete...
06-25-2015 12:50:24.417 +0200 INFO  LMTracker - init'ing slaveId=087B6B21-F296-4205-AACF-7B65A81653A6 label=MW7GVREL3MPVGT [30,30,self]
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - enabling implicit feature set
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=Acceleration state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=AdvancedSearchCommands state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=AdvancedXML state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=CustomRoles state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=GuestPass state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=KVStore state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=LDAPAuth state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=MultisiteClustering state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=NontableLookups state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=RollingWindowAlerts state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=ScheduledAlerts state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=ScheduledReports state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=SearchheadPooling state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=UnisiteClustering state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - attempting to ping master=self from slave=087B6B21-F296-4205-AACF-7B65A81653A6
06-25-2015 12:50:24.432 +0200 INFO  LMSlaveInfo - new slave='087B6B21-F296-4205-AACF-7B65A81653A6' created
06-25-2015 12:50:24.432 +0200 INFO  LMSlaveInfo - Detected that masterTimeFromSlave(Thu Jan 01 01:00:00 1970) < lastRolloverTime(Thu Jun 25 00:00:00 2015), meaning that the master has already rolled over. Ignore slave persisted usage.
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=Alerting state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=AllowDuplicateKeys state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=Auth state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=CanBeRemoteMaster state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=DeployClient state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=DeployServer state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=DistSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=FwdData state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=LocalSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=RcvData state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=RcvSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=ScheduledSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=SigningProcessor state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=SplunkWeb state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - Setting feature=SyslogOutputProcessor state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - setting masterGuid='087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - changing backwardCompatIsTrial=true
06-25-2015 12:50:24.432 +0200 INFO  LMTracker - attempting to contact master=self from slave=087B6B21-F296-4205-AACF-7B65A81653A6 success
06-25-2015 12:50:24.432 +0200 INFO  LicenseMgr - Tracker init complete...
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "MonitorNoHandle://" with 2 parameters: disabled, index
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "WinEventLog://" with 30 parameters: start_from, current_only, checkpointInterval, disabled, evt_resolve_ad_obj, evt_dc_name, evt_dns_name, index, whitelist, blacklist, whitelist1, whitelist2, whitelist3, whitelist4, whitelist5, whitelist6, whitelist7, whitelist8, whitelist9, blacklist1, blacklist2, blacklist3, blacklist4, blacklist5, blacklist6, blacklist7, blacklist8, blacklist9, suppress_text, renderXml
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "WinHostMon://" with 4 parameters: type, interval, disabled, index
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "WinNetMon://" with 15 parameters: remoteAddress, process, user, addressFamily, packetType, direction, protocol, readInterval, driverBufferSize, userBufferSize, mode, multikvMaxEventCount, multikvMaxTimeMs, disabled, index
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "WinPrintMon://" with 4 parameters: type, baseline, disabled, index
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "WinRegMon://" with 7 parameters: proc, hive, type, baseline, baseline_interval, disabled, index
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "admon://" with 7 parameters: targetDc, startingNode, monitorSubtree, disabled, index, printSchema, baseline
06-25-2015 12:50:24.464 +0200 INFO  SpecFiles - Found external scheme definition for stanza "perfmon://" with 11 parameters: object, counters, instances, interval, mode, samplingInterval, stats, disabled, index, showZeroValue, useEnglishOnly
06-25-2015 12:50:24.573 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.573 +0200 INFO  ModularInputs - Introspection setup completed for scheme "MonitorNoHandle".
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist1":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist2":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist3":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist4":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist5":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist6":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist7":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist8":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "blacklist9":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "checkpointInterval":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "current_only":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "evt_dc_name":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "evt_dns_name":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "evt_resolve_ad_obj":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "renderXml":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "start_from":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "suppress_text":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist1":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist2":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist3":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist4":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist5":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist6":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist7":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist8":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Endpoint argument settings for "whitelist9":
06-25-2015 12:50:24.713 +0200 INFO  ModularInputs - Introspection setup completed for scheme "WinEventLog".
06-25-2015 12:50:24.822 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.822 +0200 INFO  ModularInputs - Endpoint argument settings for "type":
06-25-2015 12:50:24.822 +0200 INFO  ModularInputs - Introspection setup completed for scheme "WinHostMon".
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "addressFamily":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "direction":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "driverBufferSize":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "mode":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "multikvMaxEventCount":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "multikvMaxTimeMs":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "packetType":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "process":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "protocol":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "readInterval":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "remoteAddress":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "user":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Endpoint argument settings for "userBufferSize":
06-25-2015 12:50:24.963 +0200 INFO  ModularInputs - Introspection setup completed for scheme "WinNetMon".
06-25-2015 12:50:25.072 +0200 INFO  ModularInputs - Endpoint argument settings for "baseline":
06-25-2015 12:50:25.072 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.072 +0200 INFO  ModularInputs - Endpoint argument settings for "type":
06-25-2015 12:50:25.072 +0200 INFO  ModularInputs - Introspection setup completed for scheme "WinPrintMon".
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Endpoint argument settings for "baseline":
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Endpoint argument settings for "baseline_interval":
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Endpoint argument settings for "hive":
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Endpoint argument settings for "proc":
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Endpoint argument settings for "type":
06-25-2015 12:50:25.197 +0200 INFO  ModularInputs - Introspection setup completed for scheme "WinRegMon".
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Endpoint argument settings for "baseline":
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Endpoint argument settings for "monitorSubtree":
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Endpoint argument settings for "printSchema":
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Endpoint argument settings for "startingNode":
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Endpoint argument settings for "targetDc":
06-25-2015 12:50:25.322 +0200 INFO  ModularInputs - Introspection setup completed for scheme "admon".
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "counters":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "instances":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "interval":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "mode":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "object":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "samplingInterval":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "showZeroValue":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "stats":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Endpoint argument settings for "useEnglishOnly":
06-25-2015 12:50:25.446 +0200 INFO  ModularInputs - Introspection setup completed for scheme "perfmon".
06-25-2015 12:50:25.446 +0200 INFO  ClusteringMgr - initing clustering with: ht=60 rf=3 sf=1 ct=60 st=60 rt=60 rct=60 rst=60 rrt=60 rmst=600 rmrt=600 icps=-1 sfrt=600 pe=1 im=0 is=0 mob=5 mor=5 pb=5 rep_port= pptr=10
06-25-2015 12:50:25.446 +0200 INFO  ClusteringMgr - clustering disabled
06-25-2015 12:50:25.446 +0200 INFO  SHPoolingMgr - initing shpooling with: ht=60 rf=3 ct=60 st=60 rt=60 rct=5 rst=5 rrt=10 rmst=600 rmrt=600 pe=1 im=0 is=0 mor=5 pb=5 rep_port= pptr=10
06-25-2015 12:50:25.446 +0200 INFO  SHPoolingMgr - shpooling disabled
06-25-2015 12:50:25.446 +0200 INFO  DS_DC_Common - Initializing the PubSub system.
06-25-2015 12:50:25.446 +0200 INFO  DS_DC_Common - Initializing core facilities of PubSub system.
06-25-2015 12:50:25.587 +0200 INFO  DC:DeploymentClient - target-broker clause is missing.
06-25-2015 12:50:25.587 +0200 WARN  DC:DeploymentClient - DeploymentClient explicitly disabled through config.
06-25-2015 12:50:25.587 +0200 INFO  DS_DC_Common - Deployment Client not initialized.
06-25-2015 12:50:25.587 +0200 INFO  DS_DC_Common - Loading and initializing Deployment Server...
06-25-2015 12:50:25.587 +0200 INFO  DeploymentServer - Attempting to reload entire DS; reason='init'
06-25-2015 12:50:25.587 +0200 INFO  DSManager - No serverclasses configured.
06-25-2015 12:50:25.587 +0200 INFO  DSManager - Loaded count=0 configured SCs
06-25-2015 12:50:25.587 +0200 INFO  ClientSessionsManager - Initializing ClientSessionsManager
06-25-2015 12:50:25.587 +0200 INFO  PubSubSvr - Subscribed: channel=deploymentServer/phoneHome/default connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_ds_default listener=0000000003FF7120
06-25-2015 12:50:25.587 +0200 INFO  PubSubSvr - Subscribed: channel=deploymentServer/phoneHome/default connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_ds_default listener=0000000003FF7120
06-25-2015 12:50:25.587 +0200 INFO  PubSubSvr - Subscribed: channel=deploymentServer/phoneHome/default/metrics connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_ds_default listener=0000000003FF7120
06-25-2015 12:50:25.587 +0200 INFO  DeploymentServer - Creating connection to PubSub system.
06-25-2015 12:50:25.587 +0200 INFO  PubSubSvr - Subscribed: channel=tenantService/handshake connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_tenantService listener=000000000363E1A0
06-25-2015 12:50:25.587 +0200 INFO  DS_DC_Common - Registered REST endpoint for 'broker'.
06-25-2015 12:50:25.587 +0200 INFO  DS_DC_Common - Deployment Server|Client initialized successfully.
06-25-2015 12:50:25.602 +0200 INFO  loader - win-service: Windows service is now in running state.
06-25-2015 12:50:25.602 +0200 INFO  IntrospectionGenerator:disk_objects - Enabled: indexes|volumes|dispatch=true fishbucket=true partitions=true
06-25-2015 12:50:25.602 +0200 INFO  IntrospectionGenerator:disk_objects - I-data gathering (Disk Objects) starting; period=600s
06-25-2015 12:50:25.602 +0200 INFO  IntrospectionGenerator:disk_objects - Unable to getSizeOnDisk of='C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db' (The system cannot find the file specified.).  This is normal when splunk is first starting up.
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:\Program Files\Splunk\var\run\splunk\dispatch
06-25-2015 12:50:25.602 +0200 INFO  IndexProcessor - running splunkd specific init
06-25-2015 12:50:25.602 +0200 INFO  loader - Initializing from configuration
06-25-2015 12:50:25.618 +0200 INFO  TcpOutputProc - found Whitelist forwardedindex.0.whitelist , RE : forwardedindex.0.whitelist
06-25-2015 12:50:25.618 +0200 INFO  TcpOutputProc - found Blacklist forwardedindex.1.blacklist , RE : forwardedindex.1.blacklist
06-25-2015 12:50:25.618 +0200 INFO  TcpOutputProc - found Whitelist forwardedindex.2.whitelist , RE : forwardedindex.2.whitelist
06-25-2015 12:50:25.649 +0200 INFO  IndexProcessor - Initializing: readonly=false reloading=false
06-25-2015 12:50:25.665 +0200 INFO  IndexProcessor - indexes.conf - indexThreads param autotuned to=2
06-25-2015 12:50:25.665 +0200 INFO  IndexProcessor - indexes.conf - memPoolMB param autotuned to=256MB
06-25-2015 12:50:25.665 +0200 INFO  MPool - MPool initialized: bytes=268435456 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=_audit Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=786432000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=_audit
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=_blocksignature Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=_blocksignature
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=_internal Setting hot mgr params: maxHotSpanSecs=432000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=_internal
06-25-2015 12:50:25.665 +0200 INFO  databasePartitionPolicy - idx=_audit, Initializing, params='[300,period=60,frozenTimePeriodInSecs=188697600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=786432000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=_introspection Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=1073741824 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=_introspection
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=_thefishbucket Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=524288000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=_thefishbucket
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=history Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=10485760 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=history
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=main Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=10 maxDataSizeBytes=10737418240 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=main
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - idx=summary Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=786432000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000 
06-25-2015 12:50:25.665 +0200 INFO  HotDBManager - closing hot mgr for idx=summary
06-25-2015 12:50:25.665 +0200 INFO  databasePartitionPolicy - idx=_blocksignature, Initializing, params='[300,period=60,frozenTimePeriodInSecs=0,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=1048576000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=0,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.665 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\audit\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.665 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\blockSignature\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=_blocksignature
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - idx=_internal, Initializing, params='[300,period=60,frozenTimePeriodInSecs=2592000,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=1048576000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=432000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=_audit
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - idx=_introspection, Initializing, params='[300,period=60,frozenTimePeriodInSecs=1209600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=1073741824,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_introspection\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=_introspection
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=_internal
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - idx=_thefishbucket, Initializing, params='[300,period=60,frozenTimePeriodInSecs=2419200,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=524288000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO  databasePartitionPolicy - idx=history, Initializing, params='[300,period=60,frozenTimePeriodInSecs=604800,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=10485760,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\fishbucket\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\historydb\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.696 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=_thefishbucket
06-25-2015 12:50:25.696 +0200 INFO  databasePartitionPolicy - idx=main, Initializing, params='[300,period=60,frozenTimePeriodInSecs=188697600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=10737418240,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=20,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=86400,maxHotBuckets=10,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.696 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\defaultdb\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.696 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=history
06-25-2015 12:50:25.696 +0200 INFO  databasePartitionPolicy - idx=summary, Initializing, params='[300,period=60,frozenTimePeriodInSecs=188697600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=786432000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.696 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\summarydb\db'.  Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.696 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=main
06-25-2015 12:50:25.696 +0200 INFO  databasePartitionPolicy - openDatabases complete currentId=0 idx=summary
06-25-2015 12:50:25.696 +0200 INFO  IndexProcessor - Initializing indexes took usec=31200 reloading=false indexes_initialized=8
06-25-2015 12:50:25.712 +0200 INFO  IndexProcessor - adjusting tb licences
06-25-2015 12:50:25.727 +0200 INFO  PipelineComponent - Pipeline vix disabled in default-mode.conf file
06-25-2015 12:50:25.790 +0200 WARN  AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.790 +0200 WARN  AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.790 +0200 WARN  AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.790 +0200 WARN  AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "MonitorNoHandle" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "WinEventLog" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "WinNetMon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "WinPrintMon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "WinRegMon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "admon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ModularInputs - No stanzas found for scheme "perfmon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-wmi.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 10000000000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-MonitorNoHandle.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-admon.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-netmon.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-perfmon.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: run once
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-regmon.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-winevtlog.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-winprintmon.exe"
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk/bin/splunkd" instrument-resource-usage
06-25-2015 12:50:25.805 +0200 INFO  ExecProcessor -     interval: 0 ms
06-25-2015 12:50:25.946 +0200 INFO  TcpInputConfig - SSL clause not found or servercert not provided - SSL ports will not be available
06-25-2015 12:50:25.946 +0200 INFO  TcpInputProc - Registering metrics callback for: tcpin_connections
06-25-2015 12:50:25.946 +0200 INFO  PipelineComponent - Pipeline structuredparsing disabled in default-mode.conf file
06-25-2015 12:50:25.946 +0200 INFO  PipelineComponent - Launching the pipelines.
06-25-2015 12:50:25.946 +0200 INFO  loader - Limiting REST HTTP server to 3333 sockets
06-25-2015 12:50:25.946 +0200 INFO  loader - Limiting REST HTTP server to 662 threads
06-25-2015 12:50:25.961 +0200 INFO  databasePartitionPolicy - idx=_audit Creating hot bucket=hot_v1_0, given event timestamped=1435229424
06-25-2015 12:50:25.992 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.008 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.008 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.024 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.039 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.039 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\audit\db'.  Reason='Adding bucket, bid=_audit~0~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - TailWatcher initializing...
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME\var\spool\splunk.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME\var\spool\splunk\...stash_new.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME\etc\splunk.version.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME\var\log\introspection.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME\var\log\splunk.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Adding watch on path: C:\Program Files\Splunk\etc\splunk.version.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Adding watch on path: C:\Program Files\Splunk\var\log\introspection.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Adding watch on path: C:\Program Files\Splunk\var\log\splunk.
06-25-2015 12:50:26.055 +0200 INFO  TailingProcessor - Adding watch on path: C:\Program Files\Splunk\var\spool\splunk.
06-25-2015 12:50:26.055 +0200 INFO  BatchReader - State transitioning from 2 to 0 (initOrResume).
06-25-2015 12:50:26.055 +0200 INFO  ServerRoles - Declared role=indexer.
06-25-2015 12:50:26.070 +0200 INFO  databasePartitionPolicy - idx=_internal Creating hot bucket=hot_v1_0, given event timestamped=1430226208
06-25-2015 12:50:26.070 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db'.  Reason='Adding bucket, bid=_internal~0~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:26.086 +0200 INFO  databasePartitionPolicy - idx=_introspection Creating hot bucket=hot_v1_0, given event timestamped=1435229425
06-25-2015 12:50:26.102 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_introspection\db'.  Reason='Adding bucket, bid=_introspection~0~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:26.133 +0200 INFO  databasePartitionPolicy - idx=_internal Creating hot bucket=hot_v1_1, given event timestamped=1435229331
06-25-2015 12:50:26.133 +0200 INFO  DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db'.  Reason='Adding bucket, bid=_internal~1~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:40.968 +0200 INFO  IntrospectionGenerator:resource_usage -   RU_main - I-data gathering (Resource Usage) starting; period=10s
06-25-2015 12:50:56.147 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.147 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.163 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.178 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.194 +0200 WARN  CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.958 +0200 INFO  KeyManagerLocalhost - Checking for localhost key pair
06-25-2015 12:50:56.958 +0200 INFO  KeyManagerLocalhost - Public key already exists: C:\Program Files\Splunk\etc\auth\distServerKeys\trusted.pem
06-25-2015 12:50:56.958 +0200 INFO  KeyManagerLocalhost - Reading public key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\trusted.pem
06-25-2015 12:50:56.958 +0200 INFO  KeyManagerLocalhost - Finished reading public key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\trusted.pem
06-25-2015 12:50:56.958 +0200 INFO  KeyManagerLocalhost - Reading private key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\private.pem
06-25-2015 12:50:56.958 +0200 INFO  KeyManagerLocalhost - Finished reading private key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\private.pem
1 Solution

ebissao
Engager

This problem is now fixed. I just changed the port number from 8000 to 8001, and it runs fine. It seems the port 8000 was occupied.

View solution in original post

0 Karma

ebissao
Engager

This problem is now fixed. I just changed the port number from 8000 to 8001, and it runs fine. It seems the port 8000 was occupied.

0 Karma

masonmorales
Influencer

Did you install as administrator? What happens if you cd to Splunk's bin directory and do ./splunk status?

The only real errors I see in your log are:
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:Program
FilesSplunkvarlibsplunkfishbucketsplunk_private_db
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:Program FilesSplunkvarrunsplunkdispatch

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...