Cannot start with etc/users directory which has upper case character='.DS_Store'

[nlloyd]

Hi all,

I'm getting this error periodically with my local Splunk Enterprise installation in Mac OS. I've resorted to just reinstalling when this happened in the past but I'd like to avoid that and understand the cause / fix. 

Splunk was running but seemed to hand when I tried to restart from the webUI. After that I get this error when trying to start. If I try to stop via CLI I it says splunkd is not running.

Help is very much appreciated as this is getting to be a real pain. 

[terechen]

.DS_Store is a hidden file that macOS automatically creates in directories to store custom attributes and metadata about a folder. These files are specific to macOS and are generally not needed for application functionality. In the Splunk application directory (/Applications/Splunk/etc/users), these .DS_Store files were likely created by Finder when browsing these directories.
Thanks @nlloyd, deleting that file works!

[isoutamo]

Which macOS and splunk versions you have? And Intel or Mx series workstation you have? I have never seen this, but neither browse those directories with Finder, I just use cli.

[nlloyd]

Quick update: I manually removed '.DS_Store' from the etc/users directory and could then start. I'm not sure why this issue keeps coming up but that's at least an easier fix than reinstalling.