Installation
Highlighted

Error starting splunk on Mac High Sierra.

Engager

I installed Splunk 7.0. When I click start Splunk, in the terminal I have the following error:

Splunk> Another one.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
homePath='/Applications/Splunk/var/lib/splunk/audit/db' of index=audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit
issue

When can I find the documentation to fix this error?

Labels (1)
Highlighted

Re: Error starting splunk on mac high sierra

Contributor

Hi,
Ive seen this before on my own machine:
You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:
OPTIMISTIC_ABOUT_FILE_LOCKING = 1

Then restart Splunk and it should start without any issues. Let me know how it goes!

View solution in original post

Highlighted

Re: Error starting splunk on mac high sierra

Contributor

Its also worth noting that Support for ALL versions of Splunk software on macOS 10.13 High Sierra has been REVOKED as of 23 Feb 2018.

Highlighted

Re: Error starting splunk on mac high sierra

Splunk Employee
Splunk Employee

Yes. Note that If you are concerned about your data in any way then you should not configure this bypass. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.

0 Karma
Highlighted

Re: Error starting splunk on mac high sierra

Engager

Thanks a lot.

Adding this line fixed the issue

I was able to start Splunk

0 Karma
Highlighted

Re: Error starting splunk on mac high sierra

Engager

Thanks ,adding this line fixed the issue.

0 Karma
Highlighted

Re: Error starting splunk on mac high sierra

Engager

Hi, I am trying to gain some hands-on learning of splunk on my mac (version 10.13.4, installed splunk 7.0.3). But based on related threads it seems to be a risky option for users.
1) is it safe to try setting the OPTIMISTICABOUTFILE_LOCKING = 1 configuration ?
2) in case data loss occurs on my system due to this, how do I go back to the previous setting ?
I did read in one of the answers that "There is work scheduled to fix the error for macOS 10.13" - any update on this ?

Highlighted

Re: Error starting splunk on mac high sierra

Engager

@livehybrid - so Splunk simply shouldn't be installed on Mac 10.13.x? can you point me to a link/URL for more info? tia

0 Karma
Highlighted

Re: Error starting splunk on mac high sierra

Splunk Employee
Splunk Employee

There is information about this in the documentation now: Splunk Enterprise does not start due to unusable file system.

Highlighted

Re: Error starting splunk on mac high sierra

Splunk Employee
Splunk Employee

Update: This is fixed in the Splunk Enterprise 7.1 release. The fix will also appear in a future 7.0.x maintenance release.

0 Karma