I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/local/ .
After making the changes I tried applying bundle.
[root@machine1 bin]# ./splunk apply cluster-bundle Warning: Under some circumstances, this command will initiate a rolling restart of all peers. This depends on the contents of the configuration bundle. For details, refer to the documentation. Do you wish to continue? [y/n]: y Splunk username: admin Password: Can't write file "/root/.splunk/authToken_machine1_8089": Permission denied
Yeah. pass4SymmKey is different on all the indexers and cluster master. Will change them and will keep it same for cluster master and all slave indexers. And will test then.
This is occuring because you are running this command as root, and not as the splunk user.
sudo su - splunk
And then rerun the command. This is doing this because Splunk doesnt have permissions to write the authentication token to the /root home directory, since splunk isnt running as a root user.
Either run the command as the same user as Splunk runs:
sudo -u splunk_user /path/to/splunk command
Or do the following for every user you want to run the commands (you have to insert the hostname and the mgmt port of your Splunk instance):
cd ~ mkdir .splunk chmod 777 -R .splunk touch .splunk/authToken_hostname_port chmod 600 .splunk/authToken_hostname_port