Why am I unable to disable a Deployment Client using a "splunk" user account?

[splunk_kk]

Hello Guys,

I have installed a Splunk Universal Forwarder in my environment and set the deployment server. I also have an account named "splunk" which owns /opt/splunkforwarder.

However, if I sudo to Splunk and then disable the deployment client, I'm not able to do so. I get a permission deny error. However, If I sudo to root, I'm able to disable the deployment client.

Any help why it is so?

Regards

[splunk_kk · Accepted solution]

Thanks Martin for your response. Thought I already did that in the way you told. However, the issue was, there was no home directory for splunk user so there was home directory. After I created the home directory for splunk and ran the command the issue got resolved.

[martin_mueller]

I'm guessing your forwarder runs as root, or some other user. Check with ps -Af | grep splunkd or similar to confirm.

Assuming you don't need the forwarder to run as root (if you do, work to remove that need), you should stop the forwarder, chown all files to splunk, run splunk enable boot-start -user splunk, and start splunk from the user splunk.