Failed opening seach.log

New Member

Can anyone advise me why this may be happening or how to resolve it? This has been happening since we installed a new Search Head and copied over configuration from the old Search Head. We actually have two new Search Heads, both had configurations restored from the older Search Head but only one instance is producing this error. Splunk owns all directories.

ERROR ProcessDispatchedSearch - PROCESS_SEARCH - Failed opening "${SPLUNK_DISPATCH_DIR}\search.log": Permission denied

0 Karma

Super Champion

We have seen this issue, when
- Splunk enterprise/splunkd is started as root
- But yourself/person access it as "splunk" user

To fix it, stop splunk as root
chown -R splunk:splunk /opt/splunk
then as "splunk" user, start it.

0 Karma



for the error message, it sounds like the new machine can not open files in the dispatch directory.
Maybe Splunk is started with a different user? A screenshot of an ls -al of the $SPLUNK_HOME/var/run/splunk/dispatch and $SPLUNK_HOME/var/run/splunk directory could help to solve the problem.

Also checking if the splunkd process is running as splunk user or something else (for example with top or ps -aux).

0 Karma

New Member

Hey Tom,

Thanks for the response.

ls -la of $SPLUNK_HOME/var/run/splunk/dispatch and $SPLUNK_HOME/var/run/splunk show splunk/splunk as owner. Splunkd process is also running as splunk user.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...