Getting Data In

How can Splunk running as local user impact DNS?

daniel333
Builder

All,

I have a deployment server on centOS7 for a few months now. Out of nowhere it could not send data via it's outputs.conf to the indexers. I am getting name resolution errors in the logs. Running Splunk as ROOT how ever gets rid of the problem. Any ideas why this might be happening?

Tags (2)
0 Karma

KARANMALHOTRA
Path Finder

I am not clear on the exact issue but it looks like a problem with the user account on the server. You may want to check the privilges with your CentOS admins.

Are you able to resolve the Indexer names to get the IPs if you run a nslookup command while logged in as that user?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...