I am getting this UNC path error when I try to execute
Splunk reload deploy-server: Could not create Splunk settings directory at '\MYUNCPATH\user.splunk'.
My Domain settings make my homeshare set to that UNC path, so I don't have access to the user's directory, but I do have access to my own folder.
So my question is, why does Splunk remove my home folder and drop me down a folder level?
Can I change where Splunk writes the .splunk directory myself? I'd like to keep it local where I am local admin.
You were heading down the right path figuring this out. There was a bug logged (SPL-99953) to at least get an improved error message when this happens, but I think it's on the back burner at Splunk because the impact is low and the workaround is very simple.
If you have %HOMESHARE% defined to a DFS share, it causes the Splunk cli to error out due to %HOMEPATH% getting set to root \ . It gets set this way for unknown reasons. A very simple fix is to set your HOMEPATH to something "valid", by which I mean "normal non-DFS path"
C:\Program Files\Splunk\bin>set HOMEPATH=C:\
Or any other valid local path and try your command again. Sort of a pain, but really not a big deal.
Great suggestion! I didn't realize just changing the HomePath would work.
I ended up having my domain admin change my user profile path to be a local path on the machine.