Splunk Enterprise

Splunk service won’t start on indexer

Itzmeaj
Explorer

Hello, I was wondering if anyone else has had this issue before, I just recovered an indexer from a damaged file system. When I attempt to start splunk I get an error about the xml.sax module not found, it appears as this:

splunk start 

Traceback (most recent call last):
  File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/common.py", line 16, in <module>
    from xml.sax import saxutils 
ModuleNotFoundError: No module named 'xml.sax'

This is the error from my memory, I will double check it is exactly correct tomorrow. 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

Itzmeaj
Explorer

Thank you, I should’ve tried the simplest solution first!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...