Search Peer Remote Account

[joeldavideng]

Hi,

I installed Splunk on two servers using the Debian installer package which creates an account called "splunk" that both instances are running as. I tried setting up the indexer as a search peer of the search head with the splunk account, but got an error saying "Connection reset by peer". I saw a couple of other posts saying the account needs admin privileges, but I'm not sure what privileges the other users meant. I don't want to give the splunk account unnecessary permissions. Can anyone please elaborate on what exactly the local splunk accounts need to be able to do to remote to each other? Also, I'm light on unix experience so feel free to explain it like I'm 5.

Thanks

[joeldavideng · Accepted solution]

I can't believe this is going to be on the internet forever.

The Debian install package adds the user splunk in Linux to the group splunk, but doesn't add it to the Splunk application admin group. Simply doing a "splunk add user splunk -password password splunk -role admin -auth admin:password" fixed the issue.