Splunk Enterprise

Splunk service won’t start on indexer

Itzmeaj
Explorer

Hello, I was wondering if anyone else has had this issue before, I just recovered an indexer from a damaged file system. When I attempt to start splunk I get an error about the xml.sax module not found, it appears as this:

splunk start 

Traceback (most recent call last):
  File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/common.py", line 16, in <module>
    from xml.sax import saxutils 
ModuleNotFoundError: No module named 'xml.sax'

This is the error from my memory, I will double check it is exactly correct tomorrow. 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

Itzmeaj
Explorer

Thank you, I should’ve tried the simplest solution first!

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...