- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have just installed Splunk Enterprise on Windows 7 enterprise (64 bit operating system).
After finishing the install process using the default option, the splunk does not start. I could not figure out the reason and the fix.
Can someone help me out please?
Below I have pasted the log file for details.
06-25-2015 12:50:10.314 +0200 INFO loader - win-service: Starting as a Windows service: will run various system checks first...
06-25-2015 12:50:10.314 +0200 INFO loader - win-service: Splunk starting as a local administrator
06-25-2015 12:50:10.314 +0200 INFO loader - Automatic migration of modular inputs
06-25-2015 12:50:21.656 +0200 INFO loader - win-service: Command pre-flight-checks ran successfully.
06-25-2015 12:50:24.105 +0200 INFO loader - win-service: Command check-xml-files ran successfully.
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - Will generate GUID, as none found on this server.
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - My newly generated GUID is 087B6B21-F296-4205-AACF-7B65A81653A6
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - My server name is "MW7GVREL3MPVGT".
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - Found no site defined in server.conf
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - Host name option is "".
06-25-2015 12:50:24.120 +0200 INFO ServerConfig - My hostname is "MW7GVREL3MPVGT".
06-25-2015 12:50:24.136 +0200 INFO ServerConfig - Setting HTTP server compression state=on
06-25-2015 12:50:24.136 +0200 INFO ServerConfig - Setting HTTP client compression state=0 (false)
06-25-2015 12:50:24.136 +0200 INFO ServerConfig - Default output queue for file-based input: parsingQueue.
06-25-2015 12:50:24.152 +0200 INFO loader - Splunkd starting (build 264376).
06-25-2015 12:50:24.152 +0200 INFO loader - System info: Windows, MW7GVREL3MPVGT, 1, 6, x64.
06-25-2015 12:50:24.152 +0200 INFO loader - Detected 4 (virtual) CPUs, 2 CPU cores, and 3977MB RAM
06-25-2015 12:50:24.152 +0200 INFO loader - Maximum number of threads (approximate): 1988
06-25-2015 12:50:24.152 +0200 INFO loader - Arguments are: "-p" "8089"
06-25-2015 12:50:24.152 +0200 INFO loader - Getting configuration data from: C:\Program Files\Splunk\etc\myinstall\splunkd.xml
06-25-2015 12:50:24.152 +0200 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to C:\Program Files\Splunk\etc\modules
06-25-2015 12:50:24.152 +0200 INFO loader - loading modules from C:\Program Files\Splunk\etc\modules
06-25-2015 12:50:24.152 +0200 INFO loader - Writing out composite configuration file: C:\Program Files\Splunk\var\run\splunk\composite.xml
06-25-2015 12:50:24.152 +0200 INFO BundlesSetup - Setup stats for C:\Program Files\Splunk\etc: wallclock_elapsed_msec=16, cpu_time_used=0.0156001, shared_services_generation=1, shared_services_population=1
06-25-2015 12:50:24.198 +0200 INFO loader - Setting SSL configuration.
06-25-2015 12:50:24.198 +0200 INFO loader - Server supporting SSL versions SSL3,TLS1.0,TLS1.1,TLS1.2
06-25-2015 12:50:24.198 +0200 INFO loader - Using cipher suite TLSv1+HIGH:@STRENGTH
06-25-2015 12:50:24.198 +0200 INFO loader - ECDH curve not configured
06-25-2015 12:50:24.401 +0200 INFO LicenseMgr - Initing LicenseMgr
06-25-2015 12:50:24.401 +0200 INFO LMConfig - serverName=MW7GVREL3MPVGT guid=087B6B21-F296-4205-AACF-7B65A81653A6
06-25-2015 12:50:24.401 +0200 INFO LMConfig - connection_timeout=30
06-25-2015 12:50:24.401 +0200 INFO LMConfig - send_timeout=30
06-25-2015 12:50:24.401 +0200 INFO LMConfig - receive_timeout=30
06-25-2015 12:50:24.401 +0200 INFO LMConfig - squash_threshold=2000
06-25-2015 12:50:24.401 +0200 INFO LMConfig - strict_pool_quota=1
06-25-2015 12:50:24.401 +0200 INFO LMConfig - key=pool_suggestion not found in licenser stanza of server.conf, defaulting=''
06-25-2015 12:50:24.401 +0200 INFO LicenseMgr - Initing LicenseMgr runContext_splunkd=true
06-25-2015 12:50:24.401 +0200 INFO LMStackMgr - closing stack mgr
06-25-2015 12:50:24.401 +0200 INFO LMSlaveInfo - all slaves cleared
06-25-2015 12:50:24.401 +0200 INFO LMStack - Added type=download-trial license, from file=enttrial.lic, to stack=download-trial of group=Trial
06-25-2015 12:50:24.401 +0200 INFO LMStackMgr - created stack='download-trial'
06-25-2015 12:50:24.401 +0200 INFO LMStackMgr - have to auto-set active stack group='Trial' reason='invalid/missing group id' gidStr='' oldGid=Invalid
06-25-2015 12:50:24.401 +0200 INFO LMConfig - created default pool=auto_generated_pool_download-trial for stack=download-trial
06-25-2015 12:50:24.401 +0200 INFO LMStackMgr - added default pool=auto_generated_pool_download-trial for stack=download-trial
06-25-2015 12:50:24.417 +0200 INFO LMConfig - created default pool=auto_generated_pool_forwarder for stack=forwarder
06-25-2015 12:50:24.417 +0200 INFO LMStackMgr - added default pool=auto_generated_pool_forwarder for stack=forwarder
06-25-2015 12:50:24.417 +0200 INFO LMConfig - created default pool=auto_generated_pool_free for stack=free
06-25-2015 12:50:24.417 +0200 INFO LMStackMgr - added default pool=auto_generated_pool_free for stack=free
06-25-2015 12:50:24.417 +0200 INFO ServerRoles - Declared role=license_master.
06-25-2015 12:50:24.417 +0200 INFO LMStackMgr - init completed [087B6B21-F296-4205-AACF-7B65A81653A6,Trial,runContext_splunkd=true]
06-25-2015 12:50:24.417 +0200 INFO LicenseMgr - StackMgr init complete...
06-25-2015 12:50:24.417 +0200 INFO LMTracker - init'ing slaveId=087B6B21-F296-4205-AACF-7B65A81653A6 label=MW7GVREL3MPVGT [30,30,self]
06-25-2015 12:50:24.432 +0200 INFO LMTracker - enabling implicit feature set
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=Acceleration state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=AdvancedSearchCommands state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=AdvancedXML state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=CustomRoles state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=GuestPass state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=KVStore state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=LDAPAuth state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=MultisiteClustering state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=NontableLookups state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=RollingWindowAlerts state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=ScheduledAlerts state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=ScheduledReports state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=SearchheadPooling state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=UnisiteClustering state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - attempting to ping master=self from slave=087B6B21-F296-4205-AACF-7B65A81653A6
06-25-2015 12:50:24.432 +0200 INFO LMSlaveInfo - new slave='087B6B21-F296-4205-AACF-7B65A81653A6' created
06-25-2015 12:50:24.432 +0200 INFO LMSlaveInfo - Detected that masterTimeFromSlave(Thu Jan 01 01:00:00 1970) < lastRolloverTime(Thu Jun 25 00:00:00 2015), meaning that the master has already rolled over. Ignore slave persisted usage.
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=Alerting state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=AllowDuplicateKeys state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=Auth state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=CanBeRemoteMaster state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=DeployClient state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=DeployServer state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=DistSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=FwdData state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=LocalSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=RcvData state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=RcvSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=ScheduledSearch state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=SigningProcessor state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=SplunkWeb state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - Setting feature=SyslogOutputProcessor state=ENABLED (featureStatus=1)
06-25-2015 12:50:24.432 +0200 INFO LMTracker - setting masterGuid='087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:24.432 +0200 INFO LMTracker - changing backwardCompatIsTrial=true
06-25-2015 12:50:24.432 +0200 INFO LMTracker - attempting to contact master=self from slave=087B6B21-F296-4205-AACF-7B65A81653A6 success
06-25-2015 12:50:24.432 +0200 INFO LicenseMgr - Tracker init complete...
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "MonitorNoHandle://" with 2 parameters: disabled, index
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "WinEventLog://" with 30 parameters: start_from, current_only, checkpointInterval, disabled, evt_resolve_ad_obj, evt_dc_name, evt_dns_name, index, whitelist, blacklist, whitelist1, whitelist2, whitelist3, whitelist4, whitelist5, whitelist6, whitelist7, whitelist8, whitelist9, blacklist1, blacklist2, blacklist3, blacklist4, blacklist5, blacklist6, blacklist7, blacklist8, blacklist9, suppress_text, renderXml
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "WinHostMon://" with 4 parameters: type, interval, disabled, index
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "WinNetMon://" with 15 parameters: remoteAddress, process, user, addressFamily, packetType, direction, protocol, readInterval, driverBufferSize, userBufferSize, mode, multikvMaxEventCount, multikvMaxTimeMs, disabled, index
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "WinPrintMon://" with 4 parameters: type, baseline, disabled, index
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "WinRegMon://" with 7 parameters: proc, hive, type, baseline, baseline_interval, disabled, index
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "admon://" with 7 parameters: targetDc, startingNode, monitorSubtree, disabled, index, printSchema, baseline
06-25-2015 12:50:24.464 +0200 INFO SpecFiles - Found external scheme definition for stanza "perfmon://" with 11 parameters: object, counters, instances, interval, mode, samplingInterval, stats, disabled, index, showZeroValue, useEnglishOnly
06-25-2015 12:50:24.573 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.573 +0200 INFO ModularInputs - Introspection setup completed for scheme "MonitorNoHandle".
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist1":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist2":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist3":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist4":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist5":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist6":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist7":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist8":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "blacklist9":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "checkpointInterval":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "current_only":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "evt_dc_name":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "evt_dns_name":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "evt_resolve_ad_obj":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "renderXml":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "start_from":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "suppress_text":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist1":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist2":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist3":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist4":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist5":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist6":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist7":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist8":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Endpoint argument settings for "whitelist9":
06-25-2015 12:50:24.713 +0200 INFO ModularInputs - Introspection setup completed for scheme "WinEventLog".
06-25-2015 12:50:24.822 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.822 +0200 INFO ModularInputs - Endpoint argument settings for "type":
06-25-2015 12:50:24.822 +0200 INFO ModularInputs - Introspection setup completed for scheme "WinHostMon".
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "addressFamily":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "direction":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "driverBufferSize":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "mode":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "multikvMaxEventCount":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "multikvMaxTimeMs":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "packetType":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "process":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "protocol":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "readInterval":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "remoteAddress":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "user":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Endpoint argument settings for "userBufferSize":
06-25-2015 12:50:24.963 +0200 INFO ModularInputs - Introspection setup completed for scheme "WinNetMon".
06-25-2015 12:50:25.072 +0200 INFO ModularInputs - Endpoint argument settings for "baseline":
06-25-2015 12:50:25.072 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.072 +0200 INFO ModularInputs - Endpoint argument settings for "type":
06-25-2015 12:50:25.072 +0200 INFO ModularInputs - Introspection setup completed for scheme "WinPrintMon".
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Endpoint argument settings for "baseline":
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Endpoint argument settings for "baseline_interval":
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Endpoint argument settings for "hive":
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Endpoint argument settings for "proc":
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Endpoint argument settings for "type":
06-25-2015 12:50:25.197 +0200 INFO ModularInputs - Introspection setup completed for scheme "WinRegMon".
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Endpoint argument settings for "baseline":
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Endpoint argument settings for "monitorSubtree":
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Endpoint argument settings for "printSchema":
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Endpoint argument settings for "startingNode":
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Endpoint argument settings for "targetDc":
06-25-2015 12:50:25.322 +0200 INFO ModularInputs - Introspection setup completed for scheme "admon".
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "counters":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "instances":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "interval":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "mode":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "name":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "object":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "samplingInterval":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "showZeroValue":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "stats":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Endpoint argument settings for "useEnglishOnly":
06-25-2015 12:50:25.446 +0200 INFO ModularInputs - Introspection setup completed for scheme "perfmon".
06-25-2015 12:50:25.446 +0200 INFO ClusteringMgr - initing clustering with: ht=60 rf=3 sf=1 ct=60 st=60 rt=60 rct=60 rst=60 rrt=60 rmst=600 rmrt=600 icps=-1 sfrt=600 pe=1 im=0 is=0 mob=5 mor=5 pb=5 rep_port= pptr=10
06-25-2015 12:50:25.446 +0200 INFO ClusteringMgr - clustering disabled
06-25-2015 12:50:25.446 +0200 INFO SHPoolingMgr - initing shpooling with: ht=60 rf=3 ct=60 st=60 rt=60 rct=5 rst=5 rrt=10 rmst=600 rmrt=600 pe=1 im=0 is=0 mor=5 pb=5 rep_port= pptr=10
06-25-2015 12:50:25.446 +0200 INFO SHPoolingMgr - shpooling disabled
06-25-2015 12:50:25.446 +0200 INFO DS_DC_Common - Initializing the PubSub system.
06-25-2015 12:50:25.446 +0200 INFO DS_DC_Common - Initializing core facilities of PubSub system.
06-25-2015 12:50:25.587 +0200 INFO DC:DeploymentClient - target-broker clause is missing.
06-25-2015 12:50:25.587 +0200 WARN DC:DeploymentClient - DeploymentClient explicitly disabled through config.
06-25-2015 12:50:25.587 +0200 INFO DS_DC_Common - Deployment Client not initialized.
06-25-2015 12:50:25.587 +0200 INFO DS_DC_Common - Loading and initializing Deployment Server...
06-25-2015 12:50:25.587 +0200 INFO DeploymentServer - Attempting to reload entire DS; reason='init'
06-25-2015 12:50:25.587 +0200 INFO DSManager - No serverclasses configured.
06-25-2015 12:50:25.587 +0200 INFO DSManager - Loaded count=0 configured SCs
06-25-2015 12:50:25.587 +0200 INFO ClientSessionsManager - Initializing ClientSessionsManager
06-25-2015 12:50:25.587 +0200 INFO PubSubSvr - Subscribed: channel=deploymentServer/phoneHome/default connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_ds_default listener=0000000003FF7120
06-25-2015 12:50:25.587 +0200 INFO PubSubSvr - Subscribed: channel=deploymentServer/phoneHome/default connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_ds_default listener=0000000003FF7120
06-25-2015 12:50:25.587 +0200 INFO PubSubSvr - Subscribed: channel=deploymentServer/phoneHome/default/metrics connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_ds_default listener=0000000003FF7120
06-25-2015 12:50:25.587 +0200 INFO DeploymentServer - Creating connection to PubSub system.
06-25-2015 12:50:25.587 +0200 INFO PubSubSvr - Subscribed: channel=tenantService/handshake connectionId=connection_127.0.0.1_8089_MW7GVREL3MPVGT_direct_tenantService listener=000000000363E1A0
06-25-2015 12:50:25.587 +0200 INFO DS_DC_Common - Registered REST endpoint for 'broker'.
06-25-2015 12:50:25.587 +0200 INFO DS_DC_Common - Deployment Server|Client initialized successfully.
06-25-2015 12:50:25.602 +0200 INFO loader - win-service: Windows service is now in running state.
06-25-2015 12:50:25.602 +0200 INFO IntrospectionGenerator:disk_objects - Enabled: indexes|volumes|dispatch=true fishbucket=true partitions=true
06-25-2015 12:50:25.602 +0200 INFO IntrospectionGenerator:disk_objects - I-data gathering (Disk Objects) starting; period=600s
06-25-2015 12:50:25.602 +0200 INFO IntrospectionGenerator:disk_objects - Unable to getSizeOnDisk of='C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db' (The system cannot find the file specified.). This is normal when splunk is first starting up.
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:\Program Files\Splunk\var\run\splunk\dispatch
06-25-2015 12:50:25.602 +0200 INFO IndexProcessor - running splunkd specific init
06-25-2015 12:50:25.602 +0200 INFO loader - Initializing from configuration
06-25-2015 12:50:25.618 +0200 INFO TcpOutputProc - found Whitelist forwardedindex.0.whitelist , RE : forwardedindex.0.whitelist
06-25-2015 12:50:25.618 +0200 INFO TcpOutputProc - found Blacklist forwardedindex.1.blacklist , RE : forwardedindex.1.blacklist
06-25-2015 12:50:25.618 +0200 INFO TcpOutputProc - found Whitelist forwardedindex.2.whitelist , RE : forwardedindex.2.whitelist
06-25-2015 12:50:25.649 +0200 INFO IndexProcessor - Initializing: readonly=false reloading=false
06-25-2015 12:50:25.665 +0200 INFO IndexProcessor - indexes.conf - indexThreads param autotuned to=2
06-25-2015 12:50:25.665 +0200 INFO IndexProcessor - indexes.conf - memPoolMB param autotuned to=256MB
06-25-2015 12:50:25.665 +0200 INFO MPool - MPool initialized: bytes=268435456
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=_audit Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=786432000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=_audit
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=_blocksignature Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=_blocksignature
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=_internal Setting hot mgr params: maxHotSpanSecs=432000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=1048576000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=_internal
06-25-2015 12:50:25.665 +0200 INFO databasePartitionPolicy - idx=_audit, Initializing, params='[300,period=60,frozenTimePeriodInSecs=188697600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=786432000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=_introspection Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=1073741824 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=_introspection
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=_thefishbucket Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=524288000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=_thefishbucket
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=history Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=10485760 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=history
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=main Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=10 maxDataSizeBytes=10737418240 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=main
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - idx=summary Setting hot mgr params: maxHotSpanSecs=7776000 snapBucketTimespans=false maxHotBuckets=3 maxDataSizeBytes=786432000 quarantinePastSecs=77760000 quarantineFutureSecs=2592000
06-25-2015 12:50:25.665 +0200 INFO HotDBManager - closing hot mgr for idx=summary
06-25-2015 12:50:25.665 +0200 INFO databasePartitionPolicy - idx=_blocksignature, Initializing, params='[300,period=60,frozenTimePeriodInSecs=0,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=1048576000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=0,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.665 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\audit\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.665 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\blockSignature\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=_blocksignature
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - idx=_internal, Initializing, params='[300,period=60,frozenTimePeriodInSecs=2592000,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=1048576000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=432000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=_audit
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - idx=_introspection, Initializing, params='[300,period=60,frozenTimePeriodInSecs=1209600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=1073741824,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_introspection\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=_introspection
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=_internal
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - idx=_thefishbucket, Initializing, params='[300,period=60,frozenTimePeriodInSecs=2419200,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=524288000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO databasePartitionPolicy - idx=history, Initializing, params='[300,period=60,frozenTimePeriodInSecs=604800,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=10485760,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.680 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\fishbucket\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.680 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\historydb\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.696 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=_thefishbucket
06-25-2015 12:50:25.696 +0200 INFO databasePartitionPolicy - idx=main, Initializing, params='[300,period=60,frozenTimePeriodInSecs=188697600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=10737418240,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=20,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=86400,maxHotBuckets=10,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.696 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\defaultdb\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.696 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=history
06-25-2015 12:50:25.696 +0200 INFO databasePartitionPolicy - idx=summary, Initializing, params='[300,period=60,frozenTimePeriodInSecs=188697600,coldToFrozenScript=,coldToFrozenDir=,warmToColdScript=,maxHotBucketSize=786432000,optimizeEvery=5,syncMeta=true,maxTotalDataSizeMB=500000,maxMemoryAllocationPerHotSliceMB=5,addressCompressBits=5,isReadOnly=false,maxMergizzles=6,signatureBlockSize=0,signatureDatabase=_blocksignature,maxHotSpanSecs=7776000,maxMetadataEntries=1000000,maxHotIdleSecs=0,maxHotBuckets=3,quarantinePastSecs=77760000,quarantineFutureSecs=2592000,maxSliceSize=131072,serviceMetaPeriod=25,partialServiceMetaPeriod=0,throttleCheckPeriod=15,homePath_maxDataSizeBytes=0,coldPath_maxDataSizeBytes=0,compressionLevel=-1,fsyncInterval=18446744073709551615,maxBloomBackfillBucketAge_secs=2592000,enableOnlineBucketRepair=true,maxUnreplicatedMsecWithAcks=60000,maxUnreplacatedMsecNoAcks=300000,alwaysBloomBackfill=false,minStreamGroupQueueSize=2000,streamingTargetTsidxSyncPeriodMsec=5000,repFactor=0,hotBucketTimeRefreshInterval=10]' isSlave=false needApplyDeleteJournal=false
06-25-2015 12:50:25.696 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\summarydb\db'. Reason='Refreshing manifest at start-up.'
06-25-2015 12:50:25.696 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=main
06-25-2015 12:50:25.696 +0200 INFO databasePartitionPolicy - openDatabases complete currentId=0 idx=summary
06-25-2015 12:50:25.696 +0200 INFO IndexProcessor - Initializing indexes took usec=31200 reloading=false indexes_initialized=8
06-25-2015 12:50:25.712 +0200 INFO IndexProcessor - adjusting tb licences
06-25-2015 12:50:25.727 +0200 INFO PipelineComponent - Pipeline vix disabled in default-mode.conf file
06-25-2015 12:50:25.790 +0200 WARN AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.790 +0200 WARN AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.790 +0200 WARN AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.790 +0200 WARN AuthorizationManager - Capability 'write_pdfserver' had value 'enabled' string enables Windows-specific capabilities for admin.' - only 'enabled' is valid. Ignoring...
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "MonitorNoHandle" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "WinEventLog" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "WinNetMon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "WinPrintMon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "WinRegMon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "admon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ModularInputs - No stanzas found for scheme "perfmon" in inputs.conf at script (re)start.
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-wmi.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 10000000000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-MonitorNoHandle.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-admon.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-netmon.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-perfmon.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: run once
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-regmon.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-winevtlog.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk\bin\splunk-winprintmon.exe"
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 60000 ms
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - New scheduled exec process: "C:\Program Files\Splunk/bin/splunkd" instrument-resource-usage
06-25-2015 12:50:25.805 +0200 INFO ExecProcessor - interval: 0 ms
06-25-2015 12:50:25.946 +0200 INFO TcpInputConfig - SSL clause not found or servercert not provided - SSL ports will not be available
06-25-2015 12:50:25.946 +0200 INFO TcpInputProc - Registering metrics callback for: tcpin_connections
06-25-2015 12:50:25.946 +0200 INFO PipelineComponent - Pipeline structuredparsing disabled in default-mode.conf file
06-25-2015 12:50:25.946 +0200 INFO PipelineComponent - Launching the pipelines.
06-25-2015 12:50:25.946 +0200 INFO loader - Limiting REST HTTP server to 3333 sockets
06-25-2015 12:50:25.946 +0200 INFO loader - Limiting REST HTTP server to 662 threads
06-25-2015 12:50:25.961 +0200 INFO databasePartitionPolicy - idx=_audit Creating hot bucket=hot_v1_0, given event timestamped=1435229424
06-25-2015 12:50:25.992 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.008 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.008 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.024 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.039 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:26.039 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\audit\db'. Reason='Adding bucket, bid=_audit~0~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - TailWatcher initializing...
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME\var\spool\splunk.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Parsing configuration stanza: batch://$SPLUNK_HOME\var\spool\splunk\...stash_new.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME\etc\splunk.version.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME\var\log\introspection.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Parsing configuration stanza: monitor://$SPLUNK_HOME\var\log\splunk.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Adding watch on path: C:\Program Files\Splunk\etc\splunk.version.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Adding watch on path: C:\Program Files\Splunk\var\log\introspection.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Adding watch on path: C:\Program Files\Splunk\var\log\splunk.
06-25-2015 12:50:26.055 +0200 INFO TailingProcessor - Adding watch on path: C:\Program Files\Splunk\var\spool\splunk.
06-25-2015 12:50:26.055 +0200 INFO BatchReader - State transitioning from 2 to 0 (initOrResume).
06-25-2015 12:50:26.055 +0200 INFO ServerRoles - Declared role=indexer.
06-25-2015 12:50:26.070 +0200 INFO databasePartitionPolicy - idx=_internal Creating hot bucket=hot_v1_0, given event timestamped=1430226208
06-25-2015 12:50:26.070 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db'. Reason='Adding bucket, bid=_internal~0~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:26.086 +0200 INFO databasePartitionPolicy - idx=_introspection Creating hot bucket=hot_v1_0, given event timestamped=1435229425
06-25-2015 12:50:26.102 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_introspection\db'. Reason='Adding bucket, bid=_introspection~0~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:26.133 +0200 INFO databasePartitionPolicy - idx=_internal Creating hot bucket=hot_v1_1, given event timestamped=1435229331
06-25-2015 12:50:26.133 +0200 INFO DatabaseDirectoryManager - Writing a bucket manifest in hotWarmPath='C:\Program Files\Splunk\var\lib\splunk\_internaldb\db'. Reason='Adding bucket, bid=_internal~1~087B6B21-F296-4205-AACF-7B65A81653A6'
06-25-2015 12:50:40.968 +0200 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (Resource Usage) starting; period=10s
06-25-2015 12:50:56.147 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.147 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.163 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.178 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.194 +0200 WARN CronScheduler - No suitable time found in the next 1051200 minutes
06-25-2015 12:50:56.958 +0200 INFO KeyManagerLocalhost - Checking for localhost key pair
06-25-2015 12:50:56.958 +0200 INFO KeyManagerLocalhost - Public key already exists: C:\Program Files\Splunk\etc\auth\distServerKeys\trusted.pem
06-25-2015 12:50:56.958 +0200 INFO KeyManagerLocalhost - Reading public key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\trusted.pem
06-25-2015 12:50:56.958 +0200 INFO KeyManagerLocalhost - Finished reading public key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\trusted.pem
06-25-2015 12:50:56.958 +0200 INFO KeyManagerLocalhost - Reading private key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\private.pem
06-25-2015 12:50:56.958 +0200 INFO KeyManagerLocalhost - Finished reading private key for localhost: C:\Program Files\Splunk\etc\auth\distServerKeys\private.pem
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This problem is now fixed. I just changed the port number from 8000 to 8001, and it runs fine. It seems the port 8000 was occupied.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This problem is now fixed. I just changed the port number from 8000 to 8001, and it runs fine. It seems the port 8000 was occupied.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Did you install as administrator? What happens if you cd to Splunk's bin directory and do ./splunk status?
The only real errors I see in your log are:
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:Program
FilesSplunkvarlibsplunkfishbucketsplunk_private_db
06-25-2015 12:50:25.602 +0200 ERROR DiskMon - None such on disk: C:Program FilesSplunkvarrunsplunkdispatch
