Installation

Installing Splunk to Mac OS X: failed with code '1'

ufg8tr93
Engager

Attempting to install to MacBook...I got the following error ->
Macintosh-2:~ bradbrewer$ /Applications/Splunk/bin/splunk start

Splunk> Australian for grep.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
homePath='/Applications/Splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issuestrong text****

Labels (1)
1 Solution

micahkemp
Champion

jdokken_prudent
Engager

This does seem to be specific to MacOS - and here is the fix:

You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

zzbranak2
New Member

I downvoted this post because there's no answer

0 Karma

Anam
Community Manager
Community Manager

@zzbranak2
You cannot downvote posts just because there is no answer available. You can only downvote a post if the information is misleading or harmful to your Splunk instance and you can refer to Splunk Answers guidelines for more information. We try to promote healthy discussions here since the Community Splunk Experts are trying to help people with their best. Having said that, there is an answer to this post which is posted below by @micahkemp. If that answer did not work please post a new question.

0 Karma

ufg8tr93
Engager

thanks the optimistic lock setting seems to have worked

0 Karma

micahkemp
Champion

Glad to hear it. Please accept the answer below to mark this question as closed, and you may also want to upvote the original solution, considering it contained the actual solution.

0 Karma

micahkemp
Champion

See if this helps.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Unlocking Data-In-Place Search Across Splunk and Snowflake  Enterprise data is increasingly distributed across ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...