Could not create Splunk settings directory at '/root/.splunk'

[jizzmaster]

Anytime I try to do anything with my deployment server I get this error:

An error occurred: Could not create Splunk settings directory at '/root/.splunk'

This includes the commands: splunk display deploy-server, splunk display deploy-client, and splunk reload deploy-server. I'm taking this over for another and not sure when it last worked.

Also, it kinda works. I deployed an app with it. However, I can tell there's a problem here and want to fix this.

The /root/.splunk exists. I tried deleting it, same error. I tried creating it and giving the splunk user access to it, no go. This is on a RHEL6 box, by the way. I've also restarted splunk and the same error occurs.

[jhall0007]

Were you ever able to resolve this issue?

I am also seeing the same error on a RHEL deployment server. I am suspecting Splunk should be creating the .splunk hidden file in the home directory instead of root. However, I am finding difficulty determining where this was incorrectly configured.

I am running Splunk 6.3
I am using the same account to run Splunk as execute the reload "deploy-server command"
I am running the command from sudo
The account's home is /home/accountname

[chanfoli · Accepted solution]

Yeah, I noticed some funky permissions issues executing commands which use auth sessions as the root user after upgrading from splunk 6.1 to 6.2. It looks like this is because splunkd is running as a non-root user then tries to store some auth session info or the like under the current user's home. I decided to change my practice and execute splunk CLI commands against running splunk as the splunk user and I stopped seeing such errors.

[cboillot]

I just ran into this issue and what I did was as superuser, made the '/root/.splunk' directory and changed the owner to splunk

[jrodman]

I believe that specific problem is resolved in 6.2.1.

[landen99]

I just encountered the error so it is obviously not resolved yet.