Can't write file "/root/.splunk/

[sramiz]

Hello,

Splunk version is 8.0.6. trying to configure searchHead to connect to deployer. running following command but getting an error.

sudo /opt/splunk/bin/splunk init shcluster-config -auth admin:password1 -mgmt_uri https://10.31.0.28:8089 -replication_port 9000 -replication_factor 3 -conf_deploy_fetch_url http://10.31.0.33:8089 -secret password1 -shcluster_label stg-shcluster1

Can't write file "/root/.splunk/authToken_hostname1_8089": Permission denied

splunk is running as a splunk user and have configured boot-start in systemd

Note:

1. I have read previous posts about similar error but their case is different than mine, i am not starting or have not started splunk as root user.

2. I have already added /opt/splunk/bin/splunk command in /etc/sudoers file to allow splunk user.

any suggestions?

regards,

SR

[sramiz]

Thats correct. it worked for me when I used splunk command as splunk user without sudo.

thanks

[isoutamo · Accepted solution]

Hi

1st stop splunk and after that sudo chown -R splunk:splunk /opt/splunk. Then start it again.

In your example you are trying to do that initialisation as root. Only time when you should use user root is enable boot-start (or start/stop/restart with systemd).  

The error message shows that for some reason it try to write some status information to /root/.splunk directory which didn't succeed as splunk is running as user splunk not as root.

You should do sudo -u splunk bash then run those command as user splunk. 

I propose you to use DNS names instead of IP address for hosts.

When you are adding -conf_deploy_fetch_url you must ensure that this server is up and running.

r. Ismo