topic Re: Install Add-on for Unix and Linux in Deployment Architecture

Install Add-on for Unix and Linux

ymzhangco — Wed, 23 Oct 2019 13:57:27 GMT

I installed Splunk Add-on for Unix and linux on a single Splunk server environment for testing. However, each time I go to the App, it shows the set up page. I made the selection, clicked save button, and restart the Splunk. The result is the same, always show the setup page.

How do I turn off the setup page?

Thanks,

Re: Install Add-on for Unix and Linux

kgderrekchapin — Wed, 23 Oct 2019 21:31:21 GMT

Check that the permissions/ownership of your Splunk directory are correct. I ran into a similar issue where Splunk was started as root user and when the new app was installed it was installed as the root user. Any changes that I made to that app while logged into the Splunk instance did not persist as it didn't have rights to write to the directory.

Thank you,
Derrek

Re: Install Add-on for Unix and Linux

ymzhangco — Wed, 30 Sep 2020 02:41:37 GMT

Thanks for the response. I checked the splunk process. It is run by splunk. However, I found an interesting owner/group issue for /opt/splunk/etc/apps/Splunk_TA_nix/local/inputs.conf. Each time I setup the app and save, splunk will write this file as splunk:user. What is file and/or this directory should be owned? splunk:user or splunk:splunk?

Thanks, appreciated.

Re: Install Add-on for Unix and Linux

kgderrekchapin — Fri, 25 Oct 2019 18:45:21 GMT

In my experience having it owned by splunk:splunk has given me the best results. However you should be good if that file has permissions of 750.

-Derrek

Re: Install Add-on for Unix and Linux

woodcock — Fri, 25 Oct 2019 19:45:43 GMT

Check permissions and check to be sure that the DS is not controlling that app and overwriting your changes.