Splunk Enterprise

KVStore Process Failing to Start

mdplourde
Explorer

I am running Splunk 8.1.0.1 on Windows Server 2016. The KVStore keeps failing when I start up Splunk service. This causes Splunkd server to fail after some time causing the need to restart it to access the Splunk GUI. Are there any logs I should gather to identify what the issue is?

I have read through some forums and tried the "stop Splunk, move server.pem file, start Splunk" to generate a new server certificate, but I am still getting the KVStore failure.

Any help would be greatly appreciated as I am at a loss at this point.

Labels (1)
Tags (1)
0 Karma
1 Solution

mdplourde
Explorer

D:\SplunkData\kvstore\mongo\journal\lsn

Gave full permissions to the Splunk Administrators OU.

View solution in original post

0 Karma

mdplourde
Explorer

I fixed the issue. Found out the lsn file in kvstore/mongo/journal didn't have appropriate permissions. This was in the mongod.log file after stop/start of Splunk service.

inventsekar
Super Champion

Hi @mdplourde good to know you resolved this troublesome kvstore issue.. good that you answered as well. 

maybe, you could just give us the full path of the file and the file permissions which you updated and accept your reply as the solution, so that this question will be moved from unanswered to answered. thanks. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

mdplourde
Explorer

D:\SplunkData\kvstore\mongo\journal\lsn

Gave full permissions to the Splunk Administrators OU.

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...