When i deploy Splunk for Unix TA by using deployment server, after client downloaded that app, it could't run immediately all the executable files because it hasn't enough right to do, i have to change the attributes (executable bit) of all files in ../bin/[scriptName].sh manually.
So do you know how to setup those attributes from deployment server, by which Universal Forwarder can run without touching anymore configuration files ?
Is your deployment server Windows? I'm guessing it is. My unix deployment servers don't have this issue. The Windows NTFS filesystem has no understanding of the execute-bit on files, and it is probably getting lost in translation between the two. I'm not sure there is a good solution here, and would recommend you reach out to Splunk support. Or, move your deployment server to a Linux host...
When an app is deployed by deployment server, the relevant permissions settings from the source-app in
$SPLUNK_HOME/etc/deployment-apps are effectively copied. (Some things, like setuid are probably not, but let's leave those out.) If the permissions are correct on the deployment server's copy of the app, they should be correct on each deployment client. You may need to "force" the deployment clients to re-pull the app, by doing something like a blank line at the end of a .conf file, then doing a
splunk reload deploy-server.
No, i did all of them on Linux hosts (Open Suse). I copied Splunk add-on to deployment server and copied inputs.conf from default to local. After that, when i saw Splunkd.log, it said that those such scripts couldn't run. I went into the folder and chmod 744 and then it worked .
So if i do chmod in deployment server, won't client need to change attribute manually ?