Installation

First Time Running Error - Mac OS.

wcgage
Path Finder

Trying to install and run for the first time on my Mac Mini.

Here is my error:

Williams-Mac-mini:bin williamgage$ ./splunk start --accept-license

This appears to be your first time running this version of Splunk.
Moving '/Applications/Splunk/share/splunk/search_mrsparkle/modules.new' to '/Applications/Splunk/share/splunk/search_mrsparkle/modules'.

An unforeseen error occurred:

Exception: <type 'exceptions.OSError'>, Value: [Errno 1] Operation not permitted: '/Applications/Splunk/share/splunk/search_mrsparkle/modules.new'

Traceback (most recent call last):
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 1157, in main
parseAndRun(argsList)
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 1004, in parseAndRun
retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True)
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 280, in call
return self.func(args, fromCLI)
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/control_api.py", line 30, in wrapperFunc
return func(dictCopy, fromCLI)
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/_internal.py", line 172, in firstTimeRun
comm.moveItem(migration.PATH_UI_MOD_NEW, migration.PATH_UI_MOD_ACTIVE)
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 942, in moveItem
ensureDeletable(src)
File "/Applications/Splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 979, in ensureDeletable
os.chmod(oneItem, os.stat(oneItem).st_mode | stat.S_IWRITE)
OSError: [Errno 1] Operation not permitted: '/Applications/Splunk/share/splunk/search_mrsparkle/modules.new'

Please file a case online at http://www.splunk.com/page/submit_issue

I've checked file permissions, and made sure that everything is Read/Write for myself and the admins.

Would love to know what's going on!!!

Labels (1)
0 Karma
1 Solution

wcgage
Path Finder

chown the splunk directory for Admins

View solution in original post

wcgage
Path Finder

chown the splunk directory for Admins

zakxu8
New Member

hi, i have same problem, but my splunk directory is already Admins. so anyone solution for me? thx

0 Karma

Raghav2384
Motivator

Please chown the directory to the user:group and try to do what you were doing.

Thanks,
Raghav

wcgage
Path Finder

Once I chown for the admin group, all is well!

0 Karma

Raghav2384
Motivator

Please accept the answer that helped you, @Mus's or @Raghav2384's 🙂

Hope this helps!

Thanks,
Raghav

0 Karma

MuS
SplunkTrust
SplunkTrust

Is the read/write permission also granted to the user running Splunk? Check /Applications/Splunk/etc/splunk-lauch.conffor the OS_USERsetting to see the user that will run Splunk - most likely it will be splunk

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...