Getting Data In

Why am I unable to disable a Deployment Client using a "splunk" user account?

splunk_kk
Path Finder

Hello Guys,

I have installed a Splunk Universal Forwarder in my environment and set the deployment server. I also have an account named "splunk" which owns /opt/splunkforwarder.

However, if I sudo to Splunk and then disable the deployment client, I'm not able to do so. I get a permission deny error. However, If I sudo to root, I'm able to disable the deployment client.

Any help why it is so?

Regards

0 Karma
1 Solution

splunk_kk
Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

View solution in original post

0 Karma

splunk_kk
Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm guessing your forwarder runs as root, or some other user. Check with ps -Af | grep splunkd or similar to confirm.

Assuming you don't need the forwarder to run as root (if you do, work to remove that need), you should stop the forwarder, chown all files to splunk, run splunk enable boot-start -user splunk, and start splunk from the user splunk.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!