Splunk Enterprise

Splunk service won’t start on indexer

Itzmeaj
Explorer

Hello, I was wondering if anyone else has had this issue before, I just recovered an indexer from a damaged file system. When I attempt to start splunk I get an error about the xml.sax module not found, it appears as this:

splunk start 

Traceback (most recent call last):
  File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/common.py", line 16, in <module>
    from xml.sax import saxutils 
ModuleNotFoundError: No module named 'xml.sax'

This is the error from my memory, I will double check it is exactly correct tomorrow. 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

as you said that FS was corrupted/damaged it's quite possible that there are some missing/corrupted files on this FS. If you can trust that filesystem then just install the same splunk version over current one or restore it from backups. If you cannot trust it then copy/backup the current one and create new for it, restore + install over the new FS.

r. Ismo

Itzmeaj
Explorer

Thank you, I should’ve tried the simplest solution first!

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...