Getting Data In

Splunk server failing to start due to no permission cold bucket

rsantoso_splunk
Splunk Employee
Splunk Employee

The permission is not available for user to write on the specified cold bucket directories.

Error:
Error IndexConfig - In index 'apac_network' : Failed to create directory '/opt/apac_frozen/APAC_network' (Permission denied)

Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

The issue is due to the frozen bucket is place in the /opt/xyz_frozen/ directory outside the /opt/splunk directory.
The splunk user does not have the permission to write to the /opt/xyz_frozen directory. Thus, not able to start the search head.

Creating the frozen directories for the frozen bucket and giving the permission to the user have resolved the issue.

mkdir -p /opt/xyz_frozen/XYZ_network

chown splunk_user:splunk_group /opt/xyz_frozen/XYZ_network

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

The issue is due to the frozen bucket is place in the /opt/xyz_frozen/ directory outside the /opt/splunk directory.
The splunk user does not have the permission to write to the /opt/xyz_frozen directory. Thus, not able to start the search head.

Creating the frozen directories for the frozen bucket and giving the permission to the user have resolved the issue.

mkdir -p /opt/xyz_frozen/XYZ_network

chown splunk_user:splunk_group /opt/xyz_frozen/XYZ_network

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...