Deployment Architecture

Can we change root permission of local folder in Splunk indexer machine?

sanjubaba
Path Finder

Is it ok if someone change the root permission of local folder in etc/apps/search?

I want to provide permission to all the users to access local folder.

Will this impact any functionality of Splunk?

Please guide me through this.

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

I hope splunkd service also running with root user as your $SPLUNK_HOME is owned by root user.

giving access to other user will impact only the object for which change happened. for example, you as a normal user trying to modify view, then only that particular view will be affected.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

The question is more related to Linux Permissions.

who is the owner,group of etc/apps/search?

what is the user splunkd running with?

what is the group of users for whom you want provide access of etc/apps/search?

————————————
If this helps, give a like below.

isoutamo
SplunkTrust
SplunkTrust

Hi

you could totally mesh up your installation if you give filesystem access to your users on command line level!

What is the issue which you try to solve with this?

r. Ismo

sanjubaba
Path Finder

@isoutamo @thambisetty @@I want to access the etc/apps/search/local/data/ui/views directory with my regular user to check dashboard configuration. But it is asking for root permission.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

then user you used should get sudo access to access directory as it's owned by root user.

Or, ask Linux Team to provide access  to your user for that directory.

————————————
If this helps, give a like below.

sanjubaba
Path Finder

@thambisetty thanks.

But it will not hamper my environment right?

Giving access to regular user.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

I hope splunkd service also running with root user as your $SPLUNK_HOME is owned by root user.

giving access to other user will impact only the object for which change happened. for example, you as a normal user trying to modify view, then only that particular view will be affected.

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...