Installation

Splunk 7.0.0 on Mac failing to run

cgalligan
Explorer

Trying to install Splunk on Mac, but getting the following error (with both tgz and dmg installations):

homePath='/Applications/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'.

Running Darwin

Anyone been able to resolve this?

Labels (1)
1 Solution

mattymo
Splunk Employee
Splunk Employee

Have you tried this?

Add this line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

https://answers.splunk.com/answers/453977/macos-sierra-1012-kills-splunk.html

- MattyMo

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

There is information--and warnings--about this in the documentation now: Splunk Enterprise does not start due to unusable file system.

ChrisG
Splunk Employee
Splunk Employee

Update: This is fixed in the Splunk Enterprise 7.1 release. The fix will also appear in a future 7.0.x maintenance release.

0 Karma

caplmara
New Member

That worked for me - thanks!

0 Karma

mattymo
Splunk Employee
Splunk Employee

Have you tried this?

Add this line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

https://answers.splunk.com/answers/453977/macos-sierra-1012-kills-splunk.html

- MattyMo

Rocky31
Path Finder

where to add the line in the that file can you please tell me

any specific line or any where in the file

0 Karma

caplmara
New Member

Anywhere is fine I'm sure....I added to the foot of the file

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Note that If you are concerned about your data in any way then you should not not not do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.

0 Karma

Rocky31
Path Finder

i fixed it thank you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...