Problem installing Splunk Enterprise on MacOS 10.13.1: Validating databases (splunkd validatedb) failed with code '1'

[1dodgeneon]

Trying to start the labs in the Splunk fundamentals course but Splunk won't load on my MacBook. This is the message I get:

Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

Anybody know what I should do?

[harsmarvania57]

Hi @1dodgeneon,

Can you please check answers on https://answers.splunk.com/answers/306998/why-am-i-getting-homepathoptsplunkvarlibsplunkaudi.html , this might help you.

You need to add OPTIMISTIC_ABOUT_FILE_LOCKING = 1 in $SPLUNK_HOME/etc/splunk-launch.conf

I hope this helps.

Thanks,
Harshil

[claudiavanpaasc]

I have the same issue. I'm not familiar with coding and stuff at all. Just interested in Splunk. How do I add a line in $SPLUNK_HOME/etc/splunk-launch.conf ? Could you maybe assist me? Thanks!

[sspalli]

Hi Claudia,

I am in the same boat. I am not sure what tool to use to read this file. Do you know? have you figured it out yet?

Regards,
Siva

[sumittokkar]

It worked. Thanks.

[ChrisG]

But see this important note from the other Answers posting

Note from malmoore (Splunk): You set this variable at your own risk. Proceed with caution. By setting the variable, you defeat filesystem locking checks, and thus can potentially render any data that you index inaccessible later. Splunk Free/Trial need to know how to navigate your file system so that it can store (and later retrieve) index buckets. We have already had one report in this thread of problems that have occurred after enabling this setting. There is work scheduled to fix the error for macOS 10.13, but there is no promise of delivery of this functionality. Remember, there is no support at all for Splunk Enterprise on macOS 10.13.