how to make splunkd working

[Praz_123]

splunkd is unable to restart getting an error 

Error (PROD) - Unable to extend tablespace TEMP

ERROR PersistentScript [xdr_splunk_rh_settings.py persistent]: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__..

while checking the space there is 50 percent vacant 

[livehybrid]

Hi @Praz_123 

Have you copied in a passwords.conf or other confs expecting encrypted fields from another host or Splunk server? These sorts of errors usually appear when you have copied in config and it isnt able to decode the value.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[sramamurthy2]

There are 2 issues as per the logs you have mentioned here,

1. ERROR related to the tablespace which usually reffers to the issue with the database and if you are using DB connect or Internal KV store. 

2. CredentialNotExistException: This is with regards to the Credentials and also splunk is unable to fetch the stored credentials from the passwords.conf.

Strongly feel that there is an corrupted entry in the KV store, and also let me know if there was an app which was restored and the credentials are the same too. 


Check in the logs on which app is failing because of the passwords and also check for the kvstore status and try to restart the splunk. If the Splunk doesnt get restarted then try to clean the kv store and then try to restart the splunk.