Deployment Architecture
Highlighted

Search Head Deployer create .splunk folder in home directory

Explorer

When pushing a shcluster bundle as our sudo splunk user, I got the following message:

Can't create directory "/home//.splunk": Permission denied

I was able to mod the directory so it could create .splunk, but my question is why is it creating that in my home folder?

(I was not in my home folder when the push command was run and I was using the absolute path to the bundle push command)

Thanks, all!

0 Karma
Highlighted

Re: Search Head Deployer create .splunk folder in home directory

Influencer

When you run a Splunk command that requires authentication, Splunk creates an auth token in ~/.splunk on whichever user you ran the command on. The token contains a username and session key that Splunk uses to re-authenticate itself in case you need to run additional CLI commands. This is usually not a problem if you run Splunk CLI commands from the same user that Splunk runs as.

View solution in original post

0 Karma