Deployment Architecture

Search Head Deployer create .splunk folder in home directory

vicvaughan
Explorer

When pushing a shcluster bundle as our sudo splunk user, I got the following message:

Can't create directory "/home//.splunk": Permission denied

I was able to mod the directory so it could create .splunk, but my question is why is it creating that in my home folder?

(I was not in my home folder when the push command was run and I was using the absolute path to the bundle push command)

Thanks, all!

0 Karma
1 Solution

masonmorales
Influencer

When you run a Splunk command that requires authentication, Splunk creates an auth token in ~/.splunk on whichever user you ran the command on. The token contains a username and session key that Splunk uses to re-authenticate itself in case you need to run additional CLI commands. This is usually not a problem if you run Splunk CLI commands from the same user that Splunk runs as.

View solution in original post

0 Karma

masonmorales
Influencer

When you run a Splunk command that requires authentication, Splunk creates an auth token in ~/.splunk on whichever user you ran the command on. The token contains a username and session key that Splunk uses to re-authenticate itself in case you need to run additional CLI commands. This is usually not a problem if you run Splunk CLI commands from the same user that Splunk runs as.

0 Karma

jaihingorani
Path Finder

Are there any security related concerns due to this , as this file contains the authToken ? Can this be miss used  in any possible way?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...