Hi Team,
Here I have some questions regarding `splunk.key` and `mongod.lock` file (in `/opt/splunk/var/lib/splunk/kvstore/mongo/`). The curiosity of raising these question are from `KVStore` error. When I restarted splunkd, I got errors in lookup search string.
1) when these files are created?
2) when it will be removed?
3) How mongod and splunk worked with thses files?
4) Is that any
Error :
Error in 'outputlookup' command: External command based lookup 'MY_LOOKUP' is not available because KV Store initialization has not completed yet. Please try again later.
When I removed these files ( `splunk.key` and `mongod.lock`) and again restart splunkd then it will working fine without any lookup errors . So I did not understand do I missing any configurations or else.
Kindly provide me your inputs for same.
Thanks
↧