Splunk Crashes - File deleted while splunkd was not running

Applicability

Splunk Enterprise Splunk Apps and AddOns

Description

Look for the following in a crash log generated during startup. It can be associated with any non-critical file beyond the one listed in the example:

 

Investigation

This can occur with other Add-ons. 

In this scenario then end users  are using the Okta Identity Cloud Add-on for Splunk developed by Okta and decided to use the Splunk developed Add-on for Okta Identity Cloud instead. After disabling the Okta-developed app via the UI, did not remove it from /etc/apps. The next time the service was restarted (a week later) Splunk would not come up. After disabling config_change_tracker in server.conf the instance started successfully.

The crash log has:

C++ Exception type: .?AVPropertyPagesDisabledAppException@@ what(): Application is disabled: TA-Okta_Identity_Cloud_for_Splunk GetLastError(): 3 Threads running: 98 Executable module base: 0x0x7ff684130000 Runtime: 1551.075014s argv: [Splunkd -p 8089] Regex JIT enabled Thread: "SplunkConfigChangeWatcherThread", did_join=0, ready_to_run=Y, main_thread=N, token=1340 MutexByte: MutexByte-waiting={none}

splunkd.log shows:

File deleted while splunkd was not running path=D:\Program Files\Splunk\etc\users\cballer\TA-Okta_Identity_Cloud_for_Splunk\local\ui-prefs.conf DELETED

Resolution

This can be solved in any of these three ways:

1. Add the missing conf file back and attempt to start Splunk.

2. Disable this until it is working properly by adding the following to the server.conf:

[config_change_tracker]
disabled = 1

3. Remove the app. It should resolve the crash as the config tracker will no longer have an app to track.

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release