If a DHCP is assigning IP address to your Splunk server, do not go for this.  You will also need to add the following line to /etc/system/local/web.conf  [settings] mgmtHostPort = 10.10.x.x:8089 _______________________________________________________________ Otherwise, splunk default stanza (below) will look for splunkd at its loopback address.  /opt/splunk/etc/system/default/web.conf mgmtHostPort = 127.0.0.1:8089 ... View more

Another quick way to update the ulimits is to use the chuser command. For example, "chuser fsize=-1 root" would set the max file size to unlimited. Just remember that using this method would require you to log off the specified user (assuming you are logged in as that user) and log back in. ... View more

This error means that the system cannot find a configuration value for this setting for those files. Most likely something irregular happened regarding the default conf files as they are perceived in memory, and wiping the log dir forced splunk to re-consider the splunk-specific logfiles. When tailing starts working on a file, it computes the configurations to use. In this case, an expected setting was not available or was set to blank, and you got a error. One possibility is that you upgraded from a version that does not have detect_trailing_nulls support, to a version that does, but reinstated the conf files from the older version. This message is emitted as an ERROR because it indicates that the conf files being used are not in a valid state. However, this specific setting being missing will not affect behavior, as the message states, because it is assuming the default of false and proceeding. ... View more

Looks like to some extent, different releases don't have an issue with this procedure. I've done this while upgrading from 5.0.2 to 5.0.4 (32bit only) for .tgz based installation without any noticeable issue. ... View more