topic Re: files access in Training + Certification Discussions

files access

bsirisha — Thu, 29 May 2025 06:41:47 GMT

Hi Friends,

I am new to splunk. I have created instance in google cloud and installed splunk enterprise.

Problem is iam not able to access any files like inputs.config file or outputs.conf. Even if i tried to create file with vim editor, simply am getting error "command not found".

can anyone suggest me best possible solution.

Re: files access

livehybrid — Thu, 29 May 2025 06:58:27 GMT

Hi @bsirisha

The error "command not found" for vim indicates that the vim text editor is either not installed on your Google Cloud instance or is not in the system's PATH for the user you are logged in as. This is a standard Linux operating system issue, not specific to Splunk.

You might find that other tools such as "vi" or "nano" are installed instead of vim, but if you wish to install vim specifically then you might find the following guide helpful:

Check if vim is installed: Open your terminal and run which vim. If it returns a path (like /usr/bin/vim), it's installed. If not, you'll likely get the "command not found" error again.
Install vim (if not installed): Use your distribution's package manager. For Debian/Ubuntu-based systems (like many Google Cloud images), use:
```
    sudo apt-get update
    sudo apt-get install vim
```
For RHEL/CentOS/Fedora-based systems, use:
```
    sudo yum update
    sudo yum install vim
```
You will need sudo privileges to install software.
Locate Splunk configuration files: Splunk configuration files (.conf files like inputs.conf, outputs.conf, etc.) are located within the Splunk installation directory, typically under $SPLUNK_HOME/etc/. The most common locations for local configurations are:
- $SPLUNK_HOME/etc/system/local/ (for system-wide settings)
- $SPLUNK_HOME/etc/apps/<app_name>/local/ (for app-specific settings)
- The default $SPLUNK_HOME is /opt/splunk.
Navigate and edit files: Once vim is installed and you know the location, navigate to the directory and use sudo vim to edit the file, as configuration files are often owned by the splunk user or root.

Always make a backup of configuration files before editing them.
After editing Splunk configuration files, you often need to restart Splunk or reload the deployment server/client for changes to take effect.

For more information on Splunk configuration files and their locations, refer to the Splunk documentation. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: files access

bsirisha — Thu, 29 May 2025 07:43:49 GMT

Hi bro,

It was really helpful. Thank for your suggestion. I used these commands:

sudo apt-get update
sudo apt-get install vim

So Everytime i install wget link for splunk enterprise installation, do i have to update apt-get and apt-get install.

Re: files access

bsirisha — Fri, 30 May 2025 07:35:27 GMT

Hi Friends,

I have created instance in google cloud. I have copied w get link and installed in Splunk enterprise. I am not able to access any files like inputs.conf and outputs.conf file.

when iam trying to open inputs.conf and outputs.conf file with vim editor, its simply saying "command not found".

Yesterday someone suggested to update it with following commands : sudo apt-get upgrade & sudo apt-get install. when i did the same, it worked for that respective instance.

Now when i created other instance, again same problem arises. I am not able to access inputs.conf and outputs.conf file. I tried with "sudo apt-get upgrade and sudo apt-get install. But still its throwing an error "command not found".

Please suggest me possible solutions, and let me know why is it happening everytime

Re: files access

marnall — Sun, 01 Jun 2025 18:44:50 GMT

Are you sure you used the full second command of "sudo apt-get install vim"? If so, what messages or errors did it return?

Re: files access

bsirisha — Mon, 02 Jun 2025 06:20:49 GMT

Yes for 1st instance , i have used command : "sudo apt-get install & sudo apt-get update, it worked.

But for 2nd instance, I have installed splunk with wget link and used commands: "sudo apt-get install and sudo apt-get udate, now its not working. I am not able to access any files.

When iam trying to access inputs.conf and outputs.conf file , it says command not found.