Why am I getting error "Operation not permitted" while accepting the license in Splunk on Linux Ubuntu?

[Yogen]

Hi,

I am a newbie in Splunk. I faced an error while accepting the license for Splunk. I am using Linux Ubuntu OS. The details of the error are as shown below:

This appears to be your first time running this version of Splunk.
Moving '/home/yogen6116/download/splunk/share/splunk/search_mrsparkle/modules.new' to '/home/yogen6116/download/splunk/share/splunk/search_mrsparkle/modules'.

An unforeseen error occurred:

Exception: <type 'exceptions.OSError'>, Value: [Errno 1] Operation not permitted: '/home/yogen6116/download/splunk/share/splunk/search_mrsparkle/modules.new'

Traceback (most recent call last):
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 1150, in main
    parseAndRun(argsList)
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 997, in parseAndRun
    retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True)
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py", line 280, in call
    return self.func(args, fromCLI)
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/control_api.py", line 30, in wrapperFunc
    return func(dictCopy, fromCLI)
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/_internal.py", line 160, in firstTimeRun
    comm.moveItem(migration.PATH_UI_MOD_NEW, migration.PATH_UI_MOD_ACTIVE)
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 855, in moveItem
    ensureDeletable(src)
  File "/home/yogen6116/download/splunk/lib/python2.7/site-packages/splunk/clilib/cli_common.py", line 892, in ensureDeletable
    os.chmod(oneItem, os.stat(oneItem).st_mode | stat.S_IWRITE)
OSError: [Errno 1] Operation not permitted: '/home/yogen6116/download/splunk/share/splunk/search_mrsparkle/modules.new'

I have tried many times by giving access rights to all the files and directories and still the above stated error occurs. Can anyone help me to solve this error?

[DUThibault]

The related post https://answers.splunk.com/answers/412211/first-time-running-error-mac-os.html supplied one solution: one must 'sudo -- chown -R /opt/splunk' so that the Splunk installation is no longer owned by the 'splunk' user but by the user that is trying to run splunk.

I suspect another solution may be to join the splunk user to the user's group (sudo adduser splunk ) or vice-versa (sudo adduser splunk).

Why is this not done by the Debian postinst script of splunk-6.4.1-debde650d26e-linux-2.6-amd64.deb?

[renjith_nair · Accepted solution]

Check if the user you are using to install the splunk has right permissions on the folders /home/yogen6116/download/splunk/share/splunk/search_mrsparkle/modules

Which user you are using? and can you list the directory permissions on the splunk installation directory (from base)?

[Yogen]

Thank you, Renjith for the reply. It works for me now.

[renjith_nair]

You are welcome ! So it's a permission issue ? Please mark as answer so that the thread will be closed