ERROR BTreeCP ~~~~ \snapshot.old: Access is denied. error


Getting this error on a few systems...

08-28-2016 22:03:18.924 -0400 ERROR BTreeCP  - failed: failed to rename C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot to C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old: Access is denied. 

Anyone know what file and setting I should be looking at for the fix? It seems like a authentication.conf (I'm setup for LDAP authentication) setting reference and just wanted an opinion. Thanks.



could it be that you are running the forwarder as a non-privileged user? If so, you could change the ownership of the splunkhome\var directory tree to the splunk user.


0 Karma


I have the same issue with my account. I'm trying to change the authentication.conf file to include some group mappings and it says I can't save. I am administrator on this is it because the service is still running?

0 Karma


Hello @cjsweeney1

It seems the account Splunk is being run in the Windows Server does not have the admin privileges to remove the snapshot,old file from the location.

Once the privileges are updated, Splunk would have permission to edit the file and rename it to what is required.

We had this addressed by ensuring the permissions splunk is using in the host are updated.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!