Installation

Why is Splunk Search head is not getting restarted?

sivakrishna
Path Finder

Hi Team,

I am unable to restart Splunk on my Search head. Earlier its working fine but now it's not working.

Due to this GUI of this Search head is also not able to access getting timed out.

sivakrishna_1-1690182284254.png

It's getting stopped here and no response I'm getting. I kept under observation up to 30min but no response.

web.conf

sivakrishna_2-1690182516273.png

 

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
If it’s a new installation without any real data, then probably the easiest solution is remove it and then reinstall it?

View solution in original post

0 Karma

sivakrishna
Path Finder

Getting this Splunkd.log

 

07-24-2023 09:54:21.053 +0100 ERROR BTreeCP [2041288 indexerPipe] - checkpoint failed: removal of dir %s /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old: 1 errors occurred. Description for first 1: [{operation:"failed to remove directory", error:"Directory not empty", file:"/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old"}]

0 Karma

jotne
Builder

Have you done any changes to the search head.  Use GIT or some other to track your changes if you do not use that.

0 Karma

sivakrishna
Path Finder

No Its newly installed Splunk server

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you anything in /opt/splunk/var/log/splunk/splunkd.log which could explain the reason why http service hasn’t started?

r. Ismo

0 Karma

sivakrishna
Path Finder

Getting this Splunkd.log

 

07-24-2023 09:54:21.053 +0100 ERROR BTreeCP [2041288 indexerPipe] - checkpoint failed: removal of dir. %s /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old: 1 error occurred. Description for first 1: [{operation:"failed to remove directory", error:"Directory not empty", file:"/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old"}]

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If it’s a new installation without any real data, then probably the easiest solution is remove it and then reinstall it?
0 Karma

sivakrishna
Path Finder

I tried the same thing as you suggested then Issue got Resolved.

Thank you!!!

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...