troubleshooting steps followed: 1) to make sure enough space, checked the filesystem looked fine (df -h) 2) checked the /opt/splunk folder owner(is it splunk or root) ubuntu@ubuntu:/opt/splunk$ ll total 6384 drwxr-xr-x 12 splunk splunk    4096 May  6 03:56 ./ drwxr-xr-x  4 root   root      4096 May  6 03:39 ../ -r--r--r--  1 splunk splunk     520 Apr 13 17:12 README-splunk.txt drwxr-xr-x  3 splunk splunk   12288 May  6 03:50 bin/ -r--r--r--  1 splunk splunk      57 Apr 13 17:02 copyright.txt drwxr-xr-x 17 splunk splunk    4096 May  6 03:50 etc/ -rw-r--r--  1 splunk splunk     426 May  6 03:50 ftr drwxr-xr-x  4 splunk splunk    4096 May  6 03:49 include/ drwxr-xr-x  9 splunk splunk    4096 May  6 03:50 lib/ -r--r--r--  1 splunk splunk   59708 Apr 13 17:02 license-eula.txt drwxr-xr-x  2 splunk splunk    4096 May  6 03:50 openssl/ drwxr-xr-x  8 splunk splunk    4096 May  6 03:48 opt/ drwxr-xr-x  2 splunk splunk    4096 May  6 03:50 quarantined_files/ drwxr-xr-x  5 splunk splunk    4096 May  6 03:50 share/ -r--r--r--  1 splunk splunk 6402399 Apr 13 17:51 splunk-10.2.3-4d61cf8a5c0c-linux-amd64-manifest drwxr-xr-x  2 splunk splunk    4096 May  6 03:50 swidtag/ drwx--x---3 splunk splunk    4096 May  6 03:56 var/ ubuntu@ubuntu:/opt/splunk$ i remember two folders(../ and var/) are owned by root.  so i ran "sudo chown -R splunk:splunk /opt/splunk 3) then i try to do the accept license, but still the same warning.  4) then i tried to accept license with root, but got the error: ubuntu@ubuntu:/opt/splunk$ sudo /opt/splunk/bin/splunk start --accept-license [sudo: authenticate] Password: Running Splunk Enterprise as root is deprecated and will be removed in a future release. For details, see the Release Notes. To run as root, use the --run-as-root option. ubuntu@ubuntu:/opt/splunk$  5) then ran it as splunk user, it went fine: sudo -i -u splunk /opt/splunk/bin/splunk start -accept_license buntu@ubuntu:~$ sudo -i -u splunk /opt/splunk/bin/splunk start --accept-license This appears to be your first time running this version of Splunk. Splunk software must create an administrator account during startup. Otherwise, you cannot log in. Create credentials for the administrator account. Characters do not appear on the screen when you type in credentials. Please enter an administrator username: admin Password must contain at least: * 8 total printable ASCII character(s). Please enter a new password: Please confirm new password: Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'. writing RSA key writing RSA key Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/opt/splunk/share/splunk/search_mrsparkle/modules'. Splunk> The Notorious B.I.G. D.A.T.A. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Creating: /opt/splunk/var/lib/splunk Creating: /opt/splunk/var/run/splunk/appserver/i18n Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css Creating: /opt/splunk/var/run/splunk/upload Creating: /opt/splunk/var/run/splunk/search_telemetry Creating: /opt/splunk/var/run/splunk/search_log Creating: /opt/splunk/var/spool/splunk Creating: /opt/splunk/var/spool/dirmoncache Creating: /opt/splunk/var/lib/splunk/authDb Creating: /opt/splunk/var/lib/splunk/hashDb Creating: /opt/splunk/var/run/splunk/collect Creating: /opt/splunk/var/run/splunk/sessions New certs have been generated in '/opt/splunk/etc/auth'. New certs have been generated in '/opt/splunk/etc/auth'. Checking critical directories... Done Checking indexes... Validated: _audit _configtracker _dm_summary _dsappevent _dsclient _dsphonehome _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-10.2.3-4d61cf8a5c0c-linux-amd64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Using configuration from /opt/splunk/share/openssl3/openssl.cnf ..+.+.........+.....+...............+.+.........+.....+.........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...........+...............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.....+.+.....+..........+......+.....+..........+.....+.........+....+...+..+.+..+.........+.........+.+...+.....+.+..............+......+......+.+.....+.........................+........+.......+...+..+.........+..........+...+........+...+......+....+.....+.+.....+...+.+..+.......+...+...............+...+..+...+....+...+...+......+...+..+..........+......+..+...+.......+..+.+...............+..+...+...+.+..................+..+....+.................+....+...+.....+......+.+...+...+.........+........+......+.........+..........+...+.....+...+.......+...+.........+..+....+.........+...........+.+...............+...+...........+.........+.+..+....+........+.......+..............+.......+..+...+..................+....+..................+..+............+.+........+....+.....+...+...+.+.....+.+...........................+.....+.......+......+..............+.........+.......+.........+...........+...+....+..+.............+..+.+............+..+....+......+...+...+.....+.........+....+............+.....+..................+.+...+...+.....+...+....+..+.............+.....+......+.+......+..+.+..+...+..........+......+..................+...+..+..........+..+....+.....+..........+.........+..+...+.......+........+.+.........+....................+......+.+...+.....+......+.+......+...+..+.............+..+.............+.....+.......+............+...+...+.....+................+...+..+......+...+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ .+..+.+......+...........+...+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+..+.............+..+....+...+..+....+..+...+.+...+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+......+.....+.+......+..+.+......+......+.......................+......+....+..+...+....+......+.........+..+...+...+.......+...+...+......+...+...+.........+.......................+...+...............+...+......+...+.+..+...............+...+.+..............+.+...+...........+......+..........+...+..+.........+....+...........+....+..+.+.....+...................+...+...+..+...+.........+...+.+......+........+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Warning: ignoring -extensions option without -extfile Certificate request self-signature ok subject=CN = ubuntu, O = SplunkUser Done Waiting for web server at http://127.0.0.1:8000 to be available.......................................................................................................... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://ubuntu:8000 ubuntu@ubuntu:~$ Special thanks to James Hodgkinson, MrCraig and Martin Ommerle for their suggestions on the slack, much appreciated.  ... View more