Can we change root permission of local folder in Splunk indexer machine?

[sanjubaba]

Is it ok if someone change the root permission of local folder in etc/apps/search?

I want to provide permission to all the users to access local folder.

Will this impact any functionality of Splunk?

Please guide me through this.

[thambisetty]

The question is more related to Linux Permissions.

who is the owner,group of etc/apps/search?

what is the user splunkd running with?

what is the group of users for whom you want provide access of etc/apps/search?

[isoutamo]

Hi

you could totally mesh up your installation if you give filesystem access to your users on command line level!

What is the issue which you try to solve with this?

r. Ismo

[sanjubaba]

@isoutamo @thambisetty @@I want to access the etc/apps/search/local/data/ui/views directory with my regular user to check dashboard configuration. But it is asking for root permission.

[thambisetty]

then user you used should get sudo access to access directory as it's owned by root user.

Or, ask Linux Team to provide access  to your user for that directory.

[sanjubaba]

@thambisetty thanks.

But it will not hamper my environment right?

Giving access to regular user.

[thambisetty · Accepted solution]

I hope splunkd service also running with root user as your $SPLUNK_HOME is owned by root user.

giving access to other user will impact only the object for which change happened. for example, you as a normal user trying to modify view, then only that particular view will be affected.