Splunk Enterprise Security

Any idea how I can troubleshoot this indexes.conf config?

daniel333
Builder

All,

I have this indexes.conf and added a frozen archive. The path is fully readable and writable by the Splunk user account. But when I add this config stanza the indexer fails to start. Just starting with this so I am curious what area some areas I should check.

alt text

0 Karma

fverdi
Explorer
  • Are you starting Splunk from the shell?
  • Are there any errors presented there?
  • If so, what are you seeing?

Take a look at:
$splunk_home/var/log/splunk/splunkd.log

There are several other log files in that directory that may be worth looking at including crash dumps.

0 Karma

ddrillic
Ultra Champion

What does splunkd.log say?

0 Karma
Get Updates on the Splunk Community!

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...