topic permission denied error while applying cluster bundle from cluster master to slave indexers in Deployment Architecture

permission denied error while applying cluster bundle from cluster master to slave indexers

abhinav_maxonic — Wed, 11 Jan 2017 12:24:13 GMT

I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/local/ .
After making the changes I tried applying bundle.

[root@machine1 bin]# ./splunk apply cluster-bundle
 Warning: Under some circumstances, this command will initiate a rolling restart of all peers. This depends on the contents of the configuration bundle. For details, refer to the documentation. Do you wish to continue? [y/n]: y
Splunk username: admin
Password:
Can't write file "/root/.splunk/authToken_machine1_8089": Permission denied

Whats the solution to this error ?
Why am I getting this error ?
Is there way around, other than doing it manually on each indexer ?

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

craigv_splunk — Wed, 11 Jan 2017 18:18:42 GMT

Make sure your pass4SymmKey is properly configured and contains the same value across the infrastructure

https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurepeerswithserverconf

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

abhinav_maxonic — Thu, 12 Jan 2017 04:21:04 GMT

Yeah. pass4SymmKey is different on all the indexers and cluster master. Will change them and will keep it same for cluster master and all slave indexers. And will test then.

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

esix_splunk — Thu, 12 Jan 2017 05:14:03 GMT

This is occuring because you are running this command as root, and not as the splunk user.

sudo su - splunk

And then rerun the command. This is doing this because Splunk doesnt have permissions to write the authentication token to the /root home directory, since splunk isnt running as a root user.

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

goelli — Mon, 20 Feb 2017 17:34:22 GMT

Either run the command as the same user as Splunk runs:

sudo -u splunk_user /path/to/splunk command

Or do the following for every user you want to run the commands (you have to insert the hostname and the mgmt port of your Splunk instance):

cd ~
mkdir .splunk
chmod 777 -R .splunk
touch .splunk/authToken_hostname_port
chmod 600 .splunk/authToken_hostname_port

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

gatundu_ — Fri, 07 Feb 2025 07:05:29 GMT

You also need to give permission to the splunk user to write to the volumes you are writing to on the indexer, i.e. if you have a /hot and /cold volume on the indexer, the splunk user needs to have ownership and permissions to write to these volumes.