Getting Data In

Why am I encountering the error when attempting to run Splunk in Docker for Windows?

New Member

When trying to run Splunk in Windows via LCOW, I get errors.

docker pull --platform linux splunk/splunk:latest

and running with

docker run --name splunk --hostname splunk -p 8000:8000 -d -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_USER=splunk" splunk/splunk:latest

I get the following error output in the logs:

Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'.

An unforeseen error occurred:

        Exception: <type 'exceptions.OSError'>, Value: [Errno 1] Operation not permitted: '/opt/splunk/etc/openldap/ldap.conf'

Traceback (most recent call last):
  File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/", line 1143, in main
  File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/", line 998, in parseAndRun
    retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/", line 280, in call
    return self.func(args, fromCLI)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/", line 30, in wrapperFunc
    return func(dictCopy, fromCLI)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/", line 128, in firstTimeRun
    comm.copyItem(migration.PATH_LDAP_CONF_DEF, migration.PATH_LDAP_CONF)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/", line 1008, in copyItem
    shutil.copy(src, dst)
  File "/opt/splunk/lib/python2.7/", line 120, in copy
    copymode(src, dst)
  File "/opt/splunk/lib/python2.7/", line 91, in copymode
    os.chmod(dst, mode)
OSError: [Errno 1] Operation not permitted: '/opt/splunk/etc/openldap/ldap.conf'

Please file a case online at

This appears to be your first time running this version of Splunk.

Running Docker using Linux containers works as expected, but I need to run using Windows containers for other applications.

0 Karma


Check if the user you are using to install the splunk has right permissions on the folders


Which user you are using? and can you list the directory permissions on the splunk installation directory (from base)?

0 Karma

New Member

This occurs when running as both root and splunk users. I'm pulling from Docker, which I believe is using this Dockerfile. Are you asking me to pull the Dockerfile and omit the Splunk installation section, run with -ti and check the permissions on that directory?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...