Failed opening seach.log

[q6442]

Can anyone advise me why this may be happening or how to resolve it? This has been happening since we installed a new Search Head and copied over configuration from the old Search Head. We actually have two new Search Heads, both had configurations restored from the older Search Head but only one instance is producing this error. Splunk owns all directories.

ERROR ProcessDispatchedSearch - PROCESS_SEARCH - Failed opening "${SPLUNK_DISPATCH_DIR}\search.log": Permission denied

[koshyk]

We have seen this issue, when
- Splunk enterprise/splunkd is started as root
- But yourself/person access it as "splunk" user

To fix it, stop splunk as root
chown -R splunk:splunk /opt/splunk
then as "splunk" user, start it.

[tom_frotscher]

Hi,

for the error message, it sounds like the new machine can not open files in the dispatch directory.
Maybe Splunk is started with a different user? A screenshot of an ls -al of the $SPLUNK_HOME/var/run/splunk/dispatch and $SPLUNK_HOME/var/run/splunk directory could help to solve the problem.

Also checking if the splunkd process is running as splunk user or something else (for example with top or ps -aux).

[q6442]

Hey Tom,

Thanks for the response.

ls -la of $SPLUNK_HOME/var/run/splunk/dispatch and $SPLUNK_HOME/var/run/splunk show splunk/splunk as owner. Splunkd process is also running as splunk user.