What is the reason for search head errors expecting forwarder directory?

[sakthiganesht]

Dears,

I am in the process of setting up a cluster environment. In the process while firing some commands on search heads I get error that points to "/opt/splunkforwarder/.splunk" directory. Has someone faced similar issue, what could be the reason and solution to fix this?

bash-4.2$ /opt/splunk/bin/splunk show shcluster-status
Splunk username: admin
Password:
Can't create directory "/opt/splunkforwarder/.splunk": No such file or directory

Thank you.

Regards,
Sakthi

[HoneyPatre]

I am facing the same error as your while running commands like

/opt/splunk/bin/splunk show kvstore-status

./splunk show web-port
./splunk show splunkd-port

Did you find any solution.

My machine doesn't have any forwarder configurations and splunk still believes it is forwarder.

[isoutamo]

Hi

probably you have define user splunk which home has set to /opt/splunkforwarder instead of /home/splunk? 

If your user is splunk then you could check this by 

getent passwd|awk -F: '/splunk/ {print $6}'

If it something else just update splunk to correct one.

This prints the home directory and if You haven't that directory on your system and "splunk" user haven't write access to it, you need to change it to correct one.

r. Ismo 

[Dilsheer_P]

I am also facing the issue

I can see my splunk home directory is  /opt/splunkforwarder.  I tried to change it via splunk-launc.conf but is not working.

How to change the home directory to /opt/splunk

@isoutamo 

[isoutamo]

Usually it’s best to use totally different home directory for user splunk like /home/splunk and even set this user locked and use nologin or something similar as a login shell.
I suppose that you have Unix admins or use google to switch home directory to correct one.