Archive
Highlighted

permission denied error while applying cluster bundle from cluster master to slave indexers

Path Finder

I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/local/ .
After making the changes I tried applying bundle.

[root@machine1 bin]# ./splunk apply cluster-bundle
 Warning: Under some circumstances, this command will initiate a rolling restart of all peers. This depends on the contents of the configuration bundle. For details, refer to the documentation. Do you wish to continue? [y/n]: y
Splunk username: admin
Password:
Can't write file "/root/.splunk/authToken_machine1_8089": Permission denied
  1. Whats the solution to this error ?
  2. Why am I getting this error ?
  3. Is there way around, other than doing it manually on each indexer ?
0 Karma
Highlighted

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

Splunk Employee
Splunk Employee

Make sure your pass4SymmKey is properly configured and contains the same value across the infrastructure

https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurepeerswithserverconf

Highlighted

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

Path Finder

Yeah. pass4SymmKey is different on all the indexers and cluster master. Will change them and will keep it same for cluster master and all slave indexers. And will test then.

0 Karma
Highlighted

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

Splunk Employee
Splunk Employee

This is occuring because you are running this command as root, and not as the splunk user.

sudo su - splunk

And then rerun the command. This is doing this because Splunk doesnt have permissions to write the authentication token to the /root home directory, since splunk isnt running as a root user.

View solution in original post

Highlighted

Re: permission denied error while applying cluster bundle from cluster master to slave indexers

Communicator

Either run the command as the same user as Splunk runs:

sudo -u splunk_user /path/to/splunk command

Or do the following for every user you want to run the commands (you have to insert the hostname and the mgmt port of your Splunk instance):

cd ~
mkdir .splunk
chmod 777 -R .splunk
touch .splunk/authToken_hostname_port
chmod 600 .splunk/authToken_hostname_port
0 Karma