topic Re: Could not create Splunk settings directory at '/root/.splunk' in Deployment Architecture

Could not create Splunk settings directory at '/root/.splunk'

jizzmaster — Thu, 29 Jan 2015 20:05:03 GMT

Anytime I try to do anything with my deployment server I get this error:

An error occurred: Could not create Splunk settings directory at '/root/.splunk'

This includes the commands: splunk display deploy-server, splunk display deploy-client, and splunk reload deploy-server. I'm taking this over for another and not sure when it last worked.

Also, it kinda works. I deployed an app with it. However, I can tell there's a problem here and want to fix this.

The /root/.splunk exists. I tried deleting it, same error. I tried creating it and giving the splunk user access to it, no go. This is on a RHEL6 box, by the way. I've also restarted splunk and the same error occurs.

Re: Could not create Splunk settings directory at '/root/.splunk'

chanfoli — Thu, 29 Jan 2015 20:11:44 GMT

Yeah, I noticed some funky permissions issues executing commands which use auth sessions as the root user after upgrading from splunk 6.1 to 6.2. It looks like this is because splunkd is running as a non-root user then tries to store some auth session info or the like under the current user's home. I decided to change my practice and execute splunk CLI commands against running splunk as the splunk user and I stopped seeing such errors.

Re: Could not create Splunk settings directory at '/root/.splunk'

jrodman — Tue, 10 Feb 2015 14:32:01 GMT

I believe that specific problem is resolved in 6.2.1.

Re: Could not create Splunk settings directory at '/root/.splunk'

jhall0007 — Tue, 08 Mar 2016 20:13:04 GMT

Were you ever able to resolve this issue?

I am also seeing the same error on a RHEL deployment server. I am suspecting Splunk should be creating the .splunk hidden file in the home directory instead of root. However, I am finding difficulty determining where this was incorrectly configured.

I am running Splunk 6.3
I am using the same account to run Splunk as execute the reload "deploy-server command"
I am running the command from sudo
The account's home is /home/accountname

Re: Could not create Splunk settings directory at '/root/.splunk'

landen99 — Mon, 13 Aug 2018 17:33:18 GMT

I just encountered the error so it is obviously not resolved yet.

Re: Could not create Splunk settings directory at '/root/.splunk'

cboillot — Fri, 27 May 2022 18:58:58 GMT

I just ran into this issue and what I did was as superuser, made the '/root/.splunk' directory and changed the owner to splunk