topic Re: Splunk reports first-time run failed! in Reporting

Splunk reports first-time run failed!

aagashe — Mon, 25 May 2020 02:07:53 GMT

Hi Guys,

I tried to run Splunk but it gives errors as below:

[splunk@ip-172-31-10-67 bin]$ sudo ./splunk enable boot-start -user splunk --accept-license

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Warning: cannot create "/opt/splunk/etc/licenses/download-trial"
First-time run failed!

[splunk@ip-172-31-10-67 bin]$ sudo ./splunk start --accept-license

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Warning: cannot create "/opt/splunk/etc/licenses/download-trial"

How to resolve these warnings? Also is it possible to provide a response file when we run the Splunk for the first time so I do not have to type the responses thereby we can automate without manual intervention?

Please assist.

Re: Splunk reports first-time run failed!

PavelP — Mon, 25 May 2020 05:54:54 GMT

Hello @aagashe,

it looks like a permission issue, the splunk folders and files belong to other user (or root?) or splunk is already running. It happens often if splunk installed from tgz.

Run with root privileges (change the $SPLUNK_HOME as appropriate):

sudo pkill -f splunk
sudo chown -R splunk:splunk /opt/splunk
sudo /opt/splunk/bin/splunk enable boot-start -user splunk --accept-license
sudo systemctl start splunk

The modern way to run Splunk is using systemd, so you can change it to:

    sudo pkill -f splunk
    sudo chown -R splunk:splunk /opt/splunk
    sudo ./splunk enable boot-start -user splunk -systemd-managed 1 --accept-license
    sudo systemctl start Splunkd

if you choose the last method, stick to it and start/stop splunk using "sudo systemctl" only.

Re: Splunk reports first-time run failed!

aagashe — Tue, 26 May 2020 05:45:18 GMT

Ok, how to provide username and password? When I run for the first time I have to provide username and password, I was thinking if there is a response file so that part can be automated as well.

Please guide.

Thank you.

Re: Splunk reports first-time run failed!

PavelP — Tue, 26 May 2020 07:00:47 GMT

@aagashe,

there are various scripts to install splunk on linux, also for an unattended install:

https://answers.splunk.com/search.html?f=&redirect=search%2Fsearch&sort=relevance&q=install+script+linux&type=question

Additionally check this: https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/StartSplunkforthefirsttime#Start_Splunk_Enterprise_without_prompting.2C_or_by_answering_.22yes.22_to_any_prompts