Getting Data In

Why am I unable to disable a Deployment Client using a "splunk" user account?

splunk_kk
Path Finder

Hello Guys,

I have installed a Splunk Universal Forwarder in my environment and set the deployment server. I also have an account named "splunk" which owns /opt/splunkforwarder.

However, if I sudo to Splunk and then disable the deployment client, I'm not able to do so. I get a permission deny error. However, If I sudo to root, I'm able to disable the deployment client.

Any help why it is so?

Regards

0 Karma
1 Solution

splunk_kk
Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

View solution in original post

0 Karma

splunk_kk
Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm guessing your forwarder runs as root, or some other user. Check with ps -Af | grep splunkd or similar to confirm.

Assuming you don't need the forwarder to run as root (if you do, work to remove that need), you should stop the forwarder, chown all files to splunk, run splunk enable boot-start -user splunk, and start splunk from the user splunk.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...