All Apps and Add-ons

Getting error: not readable with exception [Errno 2] No such file or directory when attempting to add a directory input.

TX_Andy01
Explorer

I am getting error [Errno 2] when attempting to add a directory \fileshare\path\path\ as an input for a DMARC directory.

0 Karma

jorritf
Path Finder

Which of these assumptions is correct?
- you're running Splunk on Windows
- you're running Splunk as LOCAL\SYSTEM
- \fileshare\path1\path2\ is on a Windows server in the same domain as the Splunk server

On Windows, UNC paths are supported on the condition that you run Splunk under a service account that can access domain resources like the share you're accessing.

If however you run Splunk as LOCAL\SYSTEM on Windows, the best I've been able to come up with is using "psexec -s -i cmd.exe" and then "net use y: //fileshare/path/path /user:domain\someuser". Domain resources aren't available to LOCAL\SYSTEM so this as an ugly workaround to make them available as Y: drive while using some non-privileged domain user.

0 Karma

TX_Andy01
Explorer
  1. I am running Splunk on Linux
  2. Splunk is running as a Local\System
  3. The fileshare is on a windows server in the same domain.
0 Karma

jorritf
Path Finder

Ah Splunk on Linux has no concept of UNC paths or Windows domains so this will never work.
Best alternative is to mount the Windows share under /mnt/something. You should probably investigate mount -t cifs.

Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...