Getting Data In
Highlighted

Why am I unable to disable a Deployment Client using a "splunk" user account?

Path Finder

Hello Guys,

I have installed a Splunk Universal Forwarder in my environment and set the deployment server. I also have an account named "splunk" which owns /opt/splunkforwarder.

However, if I sudo to Splunk and then disable the deployment client, I'm not able to do so. I get a permission deny error. However, If I sudo to root, I'm able to disable the deployment client.

Any help why it is so?

Regards

0 Karma
Highlighted

Re: Why am I unable to disable a Deployment Client using a "splunk" user account?

SplunkTrust
SplunkTrust

I'm guessing your forwarder runs as root, or some other user. Check with ps -Af | grep splunkd or similar to confirm.

Assuming you don't need the forwarder to run as root (if you do, work to remove that need), you should stop the forwarder, chown all files to splunk, run splunk enable boot-start -user splunk, and start splunk from the user splunk.

Highlighted

Re: Why am I unable to disable a Deployment Client using a "splunk" user account?

Path Finder

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

View solution in original post

0 Karma