topic Search Head Deployer create .splunk folder in home directory in Deployment Architecture

Search Head Deployer create .splunk folder in home directory

vicvaughan — Tue, 06 Jun 2017 15:11:07 GMT

When pushing a shcluster bundle as our sudo splunk user, I got the following message:

Can't create directory "/home//.splunk": Permission denied

I was able to mod the directory so it could create .splunk, but my question is why is it creating that in my home folder?

(I was not in my home folder when the push command was run and I was using the absolute path to the bundle push command)

Thanks, all!

Re: Search Head Deployer create .splunk folder in home directory

masonmorales — Tue, 06 Jun 2017 18:41:00 GMT

When you run a Splunk command that requires authentication, Splunk creates an auth token in ~/.splunk on whichever user you ran the command on. The token contains a username and session key that Splunk uses to re-authenticate itself in case you need to run additional CLI commands. This is usually not a problem if you run Splunk CLI commands from the same user that Splunk runs as.

Re: Search Head Deployer create .splunk folder in home directory

jaihingorani — Wed, 06 Sep 2023 11:21:43 GMT

Are there any security related concerns due to this , as this file contains the authToken ? Can this be miss used in any possible way?