Installation

Scripted input in UF permission denied to run the script

hpmist198
Engager

I have installed an app on the forwarder with scripted input. 
It's throwing an error while starting Splunk using 'Splunk' user 

 

 

11/9/20
9:13:20.631 PM	
11-09-2020 21:13:20.631 +0000 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/AWSMData/bin/awsmeta.sh" /bin/sh: /opt/splunkforwarder/etc/apps/AWSMetaData/bin/awsmetarun.sh: Permission denied
host = host.ip.internalindex = _internalsource = /opt/splunkforwarder/var/log/splunk/splunkd.logsourcetype = splunkd
11/9/20

 

 

I tried to set the permission to this script located under SPLUNK_HOME/etc/apps/<appname>/bin/<script>
But whenever i restart Splunk daemon, the permission revokes 

Labels (3)

vikramyadav
Contributor

Hi @hpmist198 ,

Can you please check what ownership is assign to Splunk? If proper ownership is not assigned to your path of Splunk, you can give proper permission by running the command
chown -R splunk:splunk /opt/splunk

--------------------------------------------------------

If this helps your like will be appreciated 😀

hpmist198
Engager

Yes ownership and permission looks ok for me. It's owned by splunk user and group.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
And this script has execution bit up?
You can test it by command:
/opt/splunkforwarder/bin/splunk cmd /opt/splunkforwarder/etc/apps/AWSMData/bin/awsmeta.sh and check why it don't run.
r. Ismo
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...