Installation

Error loading logging conf file - can't start Splunk Enterprise Server

rdjoraev_splunk
Splunk Employee
Splunk Employee

Not able to start Splunk.

When running "./splunk start" from the command line, Splunk Enterprise Server fails to start with the following error message:

Error loading logging conf file='/opt/splunk/etc/log.cfg'; runContext=splunkd

Tags (2)
1 Solution

rdjoraev_splunk
Splunk Employee
Splunk Employee

As per error message, root cause of the issue is related to log.cfg file in located the /opt/splunk/etc/ directory.

Checked in the splunkd.log file in $SPLUNK_HOME/var/log/splunk and observed the following message in it:

WARN Logger - /opt/splunk/etc/log.cfg:11: Parse error at "TailingProcessork....

It was found that the category.TailingProcessor parameter name was not spelled correctly. After updating the parameter name in the log.cfg file, user was able to start Splunk Server successfully.

View solution in original post

rdjoraev_splunk
Splunk Employee
Splunk Employee

As per error message, root cause of the issue is related to log.cfg file in located the /opt/splunk/etc/ directory.

Checked in the splunkd.log file in $SPLUNK_HOME/var/log/splunk and observed the following message in it:

WARN Logger - /opt/splunk/etc/log.cfg:11: Parse error at "TailingProcessork....

It was found that the category.TailingProcessor parameter name was not spelled correctly. After updating the parameter name in the log.cfg file, user was able to start Splunk Server successfully.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...