You need to unmount "/opt/splunk/var/lib/splunk/kvstore/mongo" folder. Eg. in docker-compose volumes: - "/home/docker_volumes/etc:/opt/splunk/etc" - "/home/docker_volumes/var:/opt/splunk/var" - "/opt/splunk/var/lib/splunk/kvstore/mongo" ... View more