Splunk Enterprise

How to undo a mistake made while trying to create an index and the CLI?

OgoSplunk
Path Finder

Hi,

I've been learning Splunk on my free time and at the part of my lesson that is teaching me how to add a splunk index via the CLI. I think I made a mistake with either the stanza or the key values can someone possibly help me out with this one?

 

Splunk> 4TW

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Problem parsing indexes.conf: Cannot load IndexConfig: stanza=security Required parameter=homePath not configured
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
$

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Fix it by editing the $SPLUNK_HOME/etc/system/local/indexes.conf file using your favorite text editor.  The [security] stanza should be near the bottom.  Add the homePath setting and make sure other required settings are present as well.  Save the file then run

splunk btool check

to verify all is well.  If no errors are returned then you should be able to start Splunk successfully.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Fix it by editing the $SPLUNK_HOME/etc/system/local/indexes.conf file using your favorite text editor.  The [security] stanza should be near the bottom.  Add the homePath setting and make sure other required settings are present as well.  Save the file then run

splunk btool check

to verify all is well.  If no errors are returned then you should be able to start Splunk successfully.

 

---
If this reply helps you, Karma would be appreciated.

OgoSplunk
Path Finder

Thanks for the help I'll try this out next time. I ended up just reinstalling splunk out of frustration right before you responded. I'll pass you karma for the efforts. 

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...