Error starting splunk on Mac High Sierra.

[carlotavina]

I installed Splunk 7.0. When I click start Splunk, in the terminal I have the following error

Splunk> Another one.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
homePath='/Applications/Splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

When can I find the documentation to fix this error?

[ChrisG]

There is information about this in the documentation now: Splunk Enterprise does not start due to unusable file system.

[ChrisG]

Update: This is fixed in the Splunk Enterprise 7.1 release. The fix will also appear in a future 7.0.x maintenance release.

[livehybrid · Accepted solution]

Hi,
Ive seen this before on my own machine:
You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:
OPTIMISTIC_ABOUT_FILE_LOCKING = 1

Then restart Splunk and it should start without any issues. Let me know how it goes!

[rfdin]

@livehybrid - so Splunk simply shouldn't be installed on Mac 10.13.x? can you point me to a link/URL for more info? tia

[jiakalita]

Hi, I am trying to gain some hands-on learning of splunk on my mac (version 10.13.4, installed splunk 7.0.3). But based on related threads it seems to be a risky option for users.
1) is it safe to try setting the OPTIMISTIC_ABOUT_FILE_LOCKING = 1 configuration ?
2) in case data loss occurs on my system due to this, how do I go back to the previous setting ?
I did read in one of the answers that "There is work scheduled to fix the error for macOS 10.13" - any update on this ?

[livehybrid]

Its also worth noting that Support for ALL versions of Splunk software on macOS 10.13 High Sierra has been REVOKED as of 23 Feb 2018.

[seemamalviya]

Thanks ,adding this line fixed the issue.

[carlotavina]

Thanks a lot.

Adding this line fixed the issue

I was able to start Splunk

[ChrisG]

Yes. Note that If you are concerned about your data in any way then you should not configure this bypass. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.