Splunk Light running on Docker throwing unusable filesystem

[kerberos2001]

Hello,

Today, I tried running Splunk Light into a Docker Container, but at runtime, he thrown the follow message:

shinkeji@06ba197cfe09:/opt/splunk/bin$ sudo ./splunk start
Splunk> See your world. Maybe wish you hadn't.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem.
Validating databases (splunkd validatedb) failed with code '1'. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

The splunk version here is:

Splunk 6.2.3 (build 264376)

How could I fix this? I searched on the anwsers forum, and I have seen some similar problems, but with CIFS and BTRFS. It's the same issue?

[naisanza]

You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

[naisanza]

You'll want to append the following configuration option to $SPLUNK_HOME/etc/splunk-launch.conf:

OPTIMISTIC_ABOUT_FILE_LOCKING = 1

[ejharts2015]

Works great. What exactly does this do? I can't find any documentation on that option.

[jterry]

As a base-line i'd say 1st verify that the splunkd process owner can write to /opt/splunk/var/lib/splunk/audit/db.

[jterry]

As a base-line i'd say 1st verify that the splunkd process owner can write to /opt/splunk/var/lib/splunk/audit/db.