How can Splunk running as local user impact DNS?

daniel333 · ‎09-03-2019

All,

I have a deployment server on centOS7 for a few months now. Out of nowhere it could not send data via it's outputs.conf to the indexers. I am getting name resolution errors in the logs. Running Splunk as ROOT how ever gets rid of the problem. Any ideas why this might be happening?

KARANMALHOTRA · ‎09-03-2019

I am not clear on the exact issue but it looks like a problem with the user account on the server. You may want to check the privilges with your CentOS admins.

Are you able to resolve the Indexer names to get the IPs if you run a nslookup command while logged in as that user?

How can Splunk running as local user impact DNS?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

How can Splunk running as local user impact DNS?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue