Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?

[ayushchoudhary]

I got this error while starting Splunk on the indexer.

homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem. Validating databases (splunkd validatedb) failed with code '1'. 

Please help urgently.

[zakxu8]

guys, anyone can help me. i have problem with my splunk cannot run since i have upgrade my mac os sierra to mac os high sierra 10.13

there are message :

Traceback (most recent call last):
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/site-packages/splunk/clilib/cli.py", line 17, in
import splunk.clilib.cli_common as comm
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 10, in
from xml.sax import saxutils
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/xml/sax/saxutils.py", line 6, in
import os, urlparse, urllib, types
File "/Users/zakaria/Documents/splunk-old/lib/python2.7/urllib.py", line 1440, in
from _scproxy import _get_proxy_settings, _get_proxies
ImportError: dlopen(/Users/zakaria/Documents/splunk-old/lib/python2.7/lib-dynload/_scproxy.so, 2): Symbol not found: _inflateValidate
Referenced from: /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
Expected in: /Users/zakaria/Documents/splunk-old/lib/libz.1.dylib
in /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib

i have add to my splunk-launch.cof OPTIMISTIC_ABOUT_FILE_LOCKING = 1
but still doesn't work. anyone can hel me? thanks

[Sp1unkin_it]

Thank you for this.

I ran into the same error this morning when I was installing Splunk 7.0 on Mac OS High Sierra.

This resolved the issue.

Splunkin' it!

[starcher]

This works again to get started on OSX High Sierra

[Jason_S]

The 'OPTIMISTIC_ABOUT_FILE_LOCKING = 1' appears to only be needed for OSX High Sierra running off a APFS volume. My High Sierra system running off a Mac OS Extended volume did not need this setting.

[starcher]

Yeah it is the file system type being the problem.

[hardikJsheth]

I had the same problem after upgrading to Splunk 7.0 on my mac. After I added OPTIMISTIC_ABOUT_FILE_LOCKING = 1, I was able to start the splunk.

[yannK]

This is fixed in splunk 6.5.*, the problem was for MACOS Sierra filesystem check.
For older versions you could use the workaround above, or upgrade.

[Jason_S]

yannK: I had this issue using Splunk 7.0.0 on High Sierra using APFS and have filed a support case requesting APFS support.

[aharkare]

After adding OPTIMISTIC_ABOUT_FILE_LOCKING = 1 to splunk-launch.conf file it worked for Mac OS High Sierra Version 10.13.1 (17B48). Thank you so much for the suggestion!

[Rocky31]

Hi where did you added this line OPTIMISTIC_ABOUT_FILE_LOCKING = 1

This is my splunk-launch.conf

#   Version 7.0.1

# Modify the following line to suit the location of your Splunk install.
# If unset, Splunk will use the parent of the directory containing the splunk
# CLI executable.
#
# SPLUNK_HOME=/opt/build/splunk-home

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory.  This can be overridden
# here:
#
# SPLUNK_DB=/opt/build/splunk-home/var/lib/splunk
# Splunkd daemon name
SPLUNK_SERVER_NAME=Splunkd

# Splunkweb daemon name
SPLUNK_WEB_NAME=splunkweb

# If SPLUNK_OS_USER is set, then Splunk service will only start
# if the 'splunk [re]start [splunkd]' command is invoked by a user who
# is, or can effectively become via setuid(2), $SPLUNK_OS_USER.
# (This setting can be specified as username or as UID.)
#
# SPLUNK_OS_USER

[sloshburch]

Location shouldn't matter. So long as it's not commented out (with the hash #). So feel free to just add it to the end with the necessary comments about why you included it for your own benefit in the future.

[Rocky31]

i fixed it thank you

[ff_rumali]

The comment from Dimitri mentioning Sierra triggered me to try this configuration option. It worked for me on my recently upgraded MacBook.

[heynash]

This was spot on for me. Great advice, thanks.

[Rocky31]

i have the same issue, i don't the line in splunk-launch.conf
is it i need to add the line in .conf file

[Rocky31]

i fixed it thank you