https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86633#M7357 <P>The fix for this problem is to create a home directory for the splunk account. Make sure you create it and set the appropriate permissions.</P> <PRE><CODE># mkdir /home/splunk # chown splunk /home/splunk/ # chgrp splunk /home/splunk/ </CODE></PRE> <P>Then restart splunk.</P> Thu, 26 Mar 2015 12:40:14 GMT sjscott 2015-03-26T12:40:14Z https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86631#M7355 <P>I was able to pull the checkpoint cert and verified communication son the checkpoint side.</P> <P>Log grabber is trying to execute as seen in splunkd.log but is reporting the following prolems:</P> <PRE><CODE>04-06-2013 14:24:50.718 -0500 INFO TcpOutputProc - Connected to idx=192.168.120.52:9997 04-06-2013 14:24:56.285 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:24:56.949 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:24:57.853 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:06.813 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:07.646 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:08.582 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:18.484 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:19.352 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:20.628 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity opsec" Could not look up HOME variable. Auth tokens cannot be cached. 04-06-2013 14:25:20.739 -0500 INFO TcpOutputProc - Connected to idx=192.168.120.51:9997 </CODE></PRE> <P>Does anyone have any insight?</P> Sat, 06 Apr 2013 19:27:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86631#M7355 rudyw 2013-04-06T19:27:19Z https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86632#M7356 <P>Can you verify that the user that Splunk is running as has a home directory and can write to it?</P> Tue, 09 Apr 2013 18:01:01 GMT https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86632#M7356 araitz 2013-04-09T18:01:01Z https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86633#M7357 <P>The fix for this problem is to create a home directory for the splunk account. Make sure you create it and set the appropriate permissions.</P> <PRE><CODE># mkdir /home/splunk # chown splunk /home/splunk/ # chgrp splunk /home/splunk/ </CODE></PRE> <P>Then restart splunk.</P> Thu, 26 Mar 2015 12:40:14 GMT https://community.splunk.com/t5/Monitoring-Splunk/OPSEC-LEA-2-0-1-setup-issues/m-p/86633#M7357 sjscott 2015-03-26T12:40:14Z