https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481468#M9416 <P>I assume the directories that were changes may be owned by root permissions. I would suggest you make the following changes </P> <P>As root user run the following command: </P> <PRE><CODE>chown -R splunk:splunk /opt/splunk/ </CODE></PRE> Tue, 03 Mar 2020 06:04:17 GMT sumanssah 2020-03-03T06:04:17Z https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481467#M9415 <P>I've singe SPF forwarding to 3 indexers in a cluster, after changing the file permissions to rw from rwx the splunk forwarder stopped indexing files from input dirs. have seen logs no clues found. Any suggestions when to look for errors/exceptions. TIA.</P> Tue, 03 Mar 2020 04:51:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481467#M9415 bhupalbobbadi 2020-03-03T04:51:50Z https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481468#M9416 <P>I assume the directories that were changes may be owned by root permissions. I would suggest you make the following changes </P> <P>As root user run the following command: </P> <PRE><CODE>chown -R splunk:splunk /opt/splunk/ </CODE></PRE> Tue, 03 Mar 2020 06:04:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481468#M9416 sumanssah 2020-03-03T06:04:17Z https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481469#M9417 <P>Directories have to be executable in order to <EM>do</EM> anything inside them</P> <P>It's the nature of *nix permissioning</P> Tue, 03 Mar 2020 13:46:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/splunkforwarder-stopped-forwarding-to-indexer-after-ACL-change/m-p/481469#M9417 wmyersas 2020-03-03T13:46:05Z