splunkd is not running

Exxnihiloo — Mon, 29 Apr 2024 11:53:26 GMT

I'm currently building my own home instance and I'm having some trouble with my UF.

So far I've :

installed the latest / correct version for my Ubuntu - Linux system
sudo chown -RP splunk:splunk /opt/splunkforwarder/
searched through SplunkForwarder.service to see if the correct user is applied (which it is)
tried re-installing and running

./splunk enable boot-start

as splunk user, and as root.

When using the splunk user, I have to authenticate as root anyway but i get the same results for both

./splunk start

results in "Done" after authentication

./splunk status

results in:

Warning: Attempting to revert the SPLUNK_HOME ownership

Warning: Executing "chown -R splunk:splunkfwd /opt/splunkforwarder"

Couldn't change ownership for /opt/splunkforwarder/etc : Operation not permitted

splunkd is not running.

./splunk enable boot-start

results in:

" A systemd unit file already exists at path ="/etc/systemd/system/SplunkForwarder.service". To add a Splunk generated systemd unit file, run 'splunk disable boot-start' before running this command. If there are custom settings that have been added to the unit file, create a backup copy first.

It seems no matter which account I use or which user has permissions, I'm unable to have access to any of the files under "/opt/splunkforwarder" nor am I able to start the UF itself or configure boot-start.

Re: splunkd is not running

renjith_nair — Mon, 29 Apr 2024 13:52:55 GMT

This seems to be a known issue with 9.1. As you can see a minimum privileged user splunkfwd is automatically created.

Reference : SPL-242093, SPL-242240 (https://docs.splunk.com/Documentation/Splunk/9.1.0/ReleaseNotes/KnownIssues)

Workaround - https://docs.splunk.com/Documentation/Forwarder/9.1.1/Forwarder/Installleastprivileged

Re: splunkd is not running

Exxnihiloo — Tue, 30 Apr 2024 10:09:49 GMT

Thanks for the help. Turns out I was using the "splunk:splunk" user and group instead of "splunkfwd". a clean install and correct addition of permissions helped

topic Re: splunkd is not running in Getting Data In

splunkd is not running

Re: splunkd is not running

Re: splunkd is not running