What is the reason for search head errors expecting forwarder directory?

[sakthiganesht]

Dears,

I am in the process of setting up a cluster environment. In the process while firing some commands on search heads I get error that points to "/opt/splunkforwarder/.splunk" directory. Has someone faced similar issue, what could be the reason and solution to fix this?

bash-4.2$ /opt/splunk/bin/splunk show shcluster-status
Splunk username: admin
Password:
Can't create directory "/opt/splunkforwarder/.splunk": No such file or directory

Thank you.

Regards,
Sakthi

[HoneyPatre]

I am facing the same error as your while running commands like

/opt/splunk/bin/splunk show kvstore-status

./splunk show web-port
./splunk show splunkd-port

Did you find any solution.

My machine doesn't have any forwarder configurations and splunk still believes it is forwarder.

[isoutamo]

Hi

probably you have define user splunk which home has set to /opt/splunkforwarder instead of /home/splunk? 

If your user is splunk then you could check this by 

getent passwd|awk -F: '/splunk/ {print $6}'

If it something else just update splunk to correct one.

This prints the home directory and if You haven't that directory on your system and "splunk" user haven't write access to it, you need to change it to correct one.

r. Ismo