Why am I getting a "/root/.splunk": Permission Denied error when running './splunk add forward-server ip:9997

[Sudarshankumawa]

While Forwarding Linux logs to Splunk I'm getting the error shown in the picture. Let me know if someone can me. I've setup Splunk Enterprise on ubuntu VM.

[VatsalJagani · Accepted solution]

@Sudarshankumawa - I see you are assigning the owner as vboxuser for Splunk but then running add forward-server command with root user.

I would use the user which is running Splunk for everything (running command, ownership of splunkforwarder should also be with that user).

I hope this helps!!!

[Sudarshankumawa]

Hi Vatsal,
Thank you a million times over for your response. Can you provide me with any commands that are compatible with your approach and will address this issue?

[VatsalJagani]

@Sudarshankumawa 

• Stop Splunk first.
  • You will find which user is running Splunk right now with below command:
    • ps -aux | grep splunkd
• Change ownership of files:
  • Run command with root user
    • chown -R <XYZ> /opt/splunkforwarder
  • Assuming you want to run splunk service with <XYZ> user.
• Become the right user.
  • Run command with root user.
    • su <XYZ>
• Start Splunk
  • /opt/splunkforwarder start

And then you should be able to do whatever you need with Splunk.