rpm upgrade not working...


I inherited a Splunk server that I'm trying to do an upgrade on, but the rpm keeps hanging.

rpm -Uvh splunk-6.1........

and when it tries to upgrade it hangs at:

This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server...

The server is hardened with DOD STIG, so maybe that is the issue? Which logs would I look at to get some answers?

Running RHEL 6.8

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This is likely related to user permissions.
Which user is Splunk running as?
Which user are you running the rpm upgrade as?
Also, check init script for Splunk be it init /etc/init.d/splunk or systemd e.g. /etc/systemd/system/splunk.service

0 Karma


Splunk is running as 'splunk'

The rpm upgrade is running as 'root'

What should I look for in /etc/init.d/splunk?

A side note on this: the server was running Splunk as 'root' when I first looked at it. I changed the permissions so that the user 'splunk' would run it instead.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!