Getting Data In

Why am I unable to disable a Deployment Client using a "splunk" user account?

splunk_kk
Path Finder

Hello Guys,

I have installed a Splunk Universal Forwarder in my environment and set the deployment server. I also have an account named "splunk" which owns /opt/splunkforwarder.

However, if I sudo to Splunk and then disable the deployment client, I'm not able to do so. I get a permission deny error. However, If I sudo to root, I'm able to disable the deployment client.

Any help why it is so?

Regards

0 Karma
1 Solution

splunk_kk
Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

View solution in original post

0 Karma

splunk_kk
Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm guessing your forwarder runs as root, or some other user. Check with ps -Af | grep splunkd or similar to confirm.

Assuming you don't need the forwarder to run as root (if you do, work to remove that need), you should stop the forwarder, chown all files to splunk, run splunk enable boot-start -user splunk, and start splunk from the user splunk.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...