Reporting

Splunk reports first-time run failed!

aagashe
Engager

Hi Guys,

I tried to run Splunk but it gives errors as below:

[splunk@ip-172-31-10-67 bin]$ sudo ./splunk enable boot-start -user splunk --accept-license

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Warning: cannot create "/opt/splunk/etc/licenses/download-trial"
First-time run failed!

[splunk@ip-172-31-10-67 bin]$ sudo ./splunk start --accept-license

Warning: cannot create "/opt/splunk/var/log/splunk"

Warning: cannot create "/opt/splunk/var/log/introspection"

Warning: cannot create "/opt/splunk/var/log/watchdog"
Warning: cannot create "/opt/splunk/etc/licenses/download-trial"

How to resolve these warnings? Also is it possible to provide a response file when we run the Splunk for the first time so I do not have to type the responses thereby we can automate without manual intervention?

Please assist.

Tags (1)
0 Karma

PavelP
Motivator

Hello @aagashe,

it looks like a permission issue, the splunk folders and files belong to other user (or root?) or splunk is already running. It happens often if splunk installed from tgz.

Run with root privileges (change the $SPLUNK_HOME as appropriate):

sudo pkill -f splunk
sudo chown -R splunk:splunk /opt/splunk
sudo /opt/splunk/bin/splunk enable boot-start -user splunk --accept-license
sudo systemctl start splunk

The modern way to run Splunk is using systemd, so you can change it to:

    sudo pkill -f splunk
    sudo chown -R splunk:splunk /opt/splunk
    sudo ./splunk enable boot-start -user splunk -systemd-managed 1 --accept-license
    sudo systemctl start Splunkd

if you choose the last method, stick to it and start/stop splunk using "sudo systemctl" only.

aagashe
Engager

Ok, how to provide username and password? When I run for the first time I have to provide username and password, I was thinking if there is a response file so that part can be automated as well.

Please guide.

Thank you.

0 Karma

PavelP
Motivator
0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...