In the meantime I tried three things:
Disable the lock test (link /opt/splunk/bin/locktest to /bin/true): That didn't work out because (strace to the rescue) there is an additional check in "splunkd validatedb"
Re-import the file system via nfs (changed the zfs mountpoint from /opt/splunk to /opt/splunk-local, exported the directory via nfs, and re-imported the fs to /opt/splunk): That works.
This is what was suggested as a workaround until Splunk officially supports zfs, and it works:
echo OPTIMISTIC_ABOUT_FILE_LOCKING = 1 >> /opt/splunk/etc/splunk-launch.conf
Even though the second alternative works, I am not so sure how this will work out in terms of stability and performance. I am now going with the third alternative, and I am quite happy that I don't need to kludge around with nfs.
... View more