permission denied error while applying cluster bundle from cluster master to slave indexers

[abhinav_maxonic]

I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/local/ .
After making the changes I tried applying bundle.

[root@machine1 bin]# ./splunk apply cluster-bundle
 Warning: Under some circumstances, this command will initiate a rolling restart of all peers. This depends on the contents of the configuration bundle. For details, refer to the documentation. Do you wish to continue? [y/n]: y
Splunk username: admin
Password:
Can't write file "/root/.splunk/authToken_machine1_8089": Permission denied

1. Whats the solution to this error ?
2. Why am I getting this error ?
3. Is there way around, other than doing it manually on each indexer ?

[goelli]

Either run the command as the same user as Splunk runs:

sudo -u splunk_user /path/to/splunk command

Or do the following for every user you want to run the commands (you have to insert the hostname and the mgmt port of your Splunk instance):

cd ~
mkdir .splunk
chmod 777 -R .splunk
touch .splunk/authToken_hostname_port
chmod 600 .splunk/authToken_hostname_port

[esix_splunk · Accepted solution]

This is occuring because you are running this command as root, and not as the splunk user.

sudo su - splunk

And then rerun the command. This is doing this because Splunk doesnt have permissions to write the authentication token to the /root home directory, since splunk isnt running as a root user.

[craigv_splunk]

Make sure your pass4SymmKey is properly configured and contains the same value across the infrastructure

https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurepeerswithserverconf

[abhinav_maxonic]

Yeah. pass4SymmKey is different on all the indexers and cluster master. Will change them and will keep it same for cluster master and all slave indexers. And will test then.