Splunk Universal Forwarder Crashes with 'Required parameter=defaultDatabase not configured' Error

Applicability

Description

The Splunk Universal Forwarder may crash frequently, displaying a fatal signal 6 (Aborted) error. In the splunkd.log, the following error message is observed:

ERROR IndexConfig [indexerPipe] - stanza=default Required parameter=defaultDatabase not configured

This issue occurs when the defaultDatabase parameter is missing from the indexes.conf file under the [default] stanza. The Universal Forwarder cannot proceed without this parameter, leading to crashes. 

Investigation

To determine if this issue is affecting your Splunk Universal Forwarder, perform the following steps:

Check the Crash Logs found in  $SPLUNK_HOME/var/log/splunk/crash-YYYY-MM-DD-HH:MM:SS.log for the following:

[build <build_number>] YYYY-MM-DD HH:MM:SS Received fatal signal 6 (Aborted) on PID <process_id>. 

Review splunkd.log for Error Messages: 

ERROR IndexConfig [indexerPipe] - stanza=default Required parameter=defaultDatabase not configured 

This error indicates that the defaultDatabase parameter is not configured in the indexes.conf file under the [default] stanza. 

Resolution

To resolve this issue, add the defaultDatabase parameter to the indexes.conf file:

Typically located at $SPLUNK_HOME/etc/system/local/indexes.conf or $SPLUNK_HOME/etc/apps/<your_app>/local/indexes.conf [App Specific] 

• Add the defaultDatabase Parameter: 
• Ensure that the [default] stanza includes the defaultDatabase parameter. For example: 

[default] 
defaultDatabase = main 

• Replace main with the appropriate index name that exists and is enabled on your indexers. 
• Save the changes made to the indexes.conf file. 
• Use the btool command to validate the configuration and check for syntax errors: 

$SPLUNK_HOME/bin/splunk btool indexes list --debug

• Restart the Universal Forwarder to apply the changes: 

$SPLUNK_HOME/bin/splunk restart 

• After completing these steps, the Splunk Universal Forwarder should operate without crashing due to the missing defaultDatabase parameter. 

Related Links

Indexes.conf.spec