Error loading logging conf file - can't start Splunk Enterprise Server

[rdjoraev_splunk]

Not able to start Splunk.

When running "./splunk start" from the command line, Splunk Enterprise Server fails to start with the following error message:

Error loading logging conf file='/opt/splunk/etc/log.cfg'; runContext=splunkd

[rdjoraev_splunk · Accepted solution]

As per error message, root cause of the issue is related to log.cfg file in located the /opt/splunk/etc/ directory.

Checked in the splunkd.log file in $SPLUNK_HOME/var/log/splunk and observed the following message in it:

WARN Logger - /opt/splunk/etc/log.cfg:11: Parse error at "TailingProcessork....

It was found that the category.TailingProcessor parameter name was not spelled correctly. After updating the parameter name in the log.cfg file, user was able to start Splunk Server successfully.