topic Re: Attempting to revert the SPLUNK_HOME ownership in Splunk Enterprise

Attempting to revert the SPLUNK_HOME ownership?

Skeer-Jamf — Tue, 18 Jul 2023 15:54:42 GMT

This happens regardless of it I am installing fresh or upgrading to version 9.1.0.1an existing install. Every action that involves the splunk binary prepends all output with:

Warning: Attempting to revert the SPLUNK_HOME ownership
Warning: Executing "chown -R splunkfwd /opt/splunkforwarder"

I've tried manually running that, as Root! And it still persists even though now the contents under /opt/splunkforwarder are owned by splunkfwd recursively!

Re: Attempting to revert the SPLUNK_HOME ownership

SanjayReddy — Mon, 17 Jul 2023 18:43:42 GMT

Hi @Skeer-Jamf

this is known issue, as long as splunkforwarder owned by correct user and working as expected, it wont cause any issue, refercene to known issues of UF

https://docs.splunk.com/Documentation/Splunk/9.1.0/ReleaseNotes/Knownissues

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated.
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

Re: Attempting to revert the SPLUNK_HOME ownership

Skeer-Jamf — Mon, 17 Jul 2023 19:13:48 GMT

Thank you Sanjay, so yet another known issue huh? Upgrading/installing version 9 has a few it seems.

So, being as though I'm sure this is low priority is there any ETA on it at all? I have automation that handles the installing of the UF. Now when checking the returns/results of a service restart I need to make sure to include bits to ensure the 'Warning' generated doesn't cause me problems.

Re: Attempting to revert the SPLUNK_HOME ownership

patng_nw — Tue, 14 Nov 2023 02:40:41 GMT

I want to point out that these two warnings are breaking my jobs because on some machines I am using the splunkforwarder CLI to run query on the splunk cluster and export the result to files.

https://docs.splunk.com/Documentation/Splunk/9.1.1/Search/ExportdatausingCLI

These two extra warning lines were now written to the export files as well.

I think it is ok for the CLI to print warnings, but the splunk CLI should follow the best practice and write these warnings to the stderr. But it's writing them to the stdout, so that we can't use the standard practice of " 2> err.txt 1> export.csv" to handle warnings.

Now I have to add these to ALL the script files which are running the splunkforwarder CLI, which is pretty ugly:
" | grep -vi "warning:" > export.csv"

Wish there is a flag to disable warnings, or the splunkforwarder CLI should at least write them to stderr instead of stdout.

Re: Attempting to revert the SPLUNK_HOME ownership

jfrench — Wed, 07 Feb 2024 03:04:58 GMT

It is a breaking issue as I cannot run btool on my forwarders that are throwing this message.

Re: Attempting to revert the SPLUNK_HOME ownership

SierraX369 — Wed, 02 Jul 2025 07:28:57 GMT

btool is a own program in $SPLUNK_HOME/bin
It is a bit more tricky to use because you have to be in splunk env.

I tested successful following procedure on UF 9.2.2

. /opt/splunkforwarder/bin/setSplunkEnv btool inputs list

without sourcing the Splunk Env you get missing libraries error:

/opt/splunkforwarder/bin/btool inputs list /opt/splunkforwarder/bin/splunkd: error while loading shared libraries: libmongoc-1.0.so.0: cannot open shared object file: No such file or directory

Re: Attempting to revert the SPLUNK_HOME ownership

SierraX369 — Wed, 02 Jul 2025 09:16:56 GMT

A bit less ugly is to use `| sed -n '3,$p' > export.csv `

Re: Attempting to revert the SPLUNK_HOME ownership?

yoho — Mon, 11 Aug 2025 09:54:10 GMT

Still a known issue in Splunk 10.0 : SPL-226019