rpm upgrade not working...


I inherited a Splunk server that I'm trying to do an upgrade on, but the rpm keeps hanging.

rpm -Uvh splunk-6.1........

and when it tries to upgrade it hangs at:

This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server...

The server is hardened with DOD STIG, so maybe that is the issue? Which logs would I look at to get some answers?

Running RHEL 6.8

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This is likely related to user permissions.
Which user is Splunk running as?
Which user are you running the rpm upgrade as?
Also, check init script for Splunk be it init /etc/init.d/splunk or systemd e.g. /etc/systemd/system/splunk.service

0 Karma


Splunk is running as 'splunk'

The rpm upgrade is running as 'root'

What should I look for in /etc/init.d/splunk?

A side note on this: the server was running Splunk as 'root' when I first looked at it. I changed the permissions so that the user 'splunk' would run it instead.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!