Splunk 7.0.0 on Mac failing to run

[cgalligan]

Trying to install Splunk on Mac, but getting the following error (with both tgz and dmg installations):

homePath='/Applications/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'.

Running Darwin

Anyone been able to resolve this?

[ChrisG]

There is information--and warnings--about this in the documentation now: Splunk Enterprise does not start due to unusable file system.

[ChrisG]

Update: This is fixed in the Splunk Enterprise 7.1 release. The fix will also appear in a future 7.0.x maintenance release.

[caplmara]

That worked for me - thanks!

[mattymo · Accepted solution]

Have you tried this?

Add this line to $SPLUNK_HOME/etc/splunk-launch.conf

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

https://answers.splunk.com/answers/453977/macos-sierra-1012-kills-splunk.html

[Rocky31]

where to add the line in the that file can you please tell me

any specific line or any where in the file

[caplmara]

Anywhere is fine I'm sure....I added to the foot of the file

[ChrisG]

Note that If you are concerned about your data in any way then you should not not not do this. This variable basically drops all filesystem lock checks and any data you store might or might not be retrievable.

[Rocky31]

i fixed it thank you