So I added a new index and without thinking I hit submit without changed db info. I restarted and now I can get splunk up as you can see below. Anyone know how to remove an index reference with splunk not running?
Checking http port : open
Checking mgmt port : open
Checking configuration... Done.
Checking index directory...
Problem parsing indexes.conf: The homePath "/opt/splunk/var/lib/splunk/defaultdb/db" of index "nms" is repeated multiple times (already specified as homePath of index "main").
Validating databases (splunkd validatedb) failed with code '1'. Please file a case online at http://www.splunk.com/page/submit_issue
root@atpscld1>/opt/splunk/bin/splunk disable index nms
Splunk is not running, and it must be for this operation. To start splunk, run "splunk start".
You should find your new one in $SPLUNK_HOME/etc/system/local/indexes.conf.
Just open the conf and delete the lines relevant to the faulty index and restart splunk and all should be well again, you can then add it via the conf file (as per the link) or have another go through the UI 🙂