ERROR BTreeCP ~~~~ \snapshot.old: Access is denied. error


Getting this error on a few systems...

08-28-2016 22:03:18.924 -0400 ERROR BTreeCP  - failed: failed to rename C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot to C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\fishbucket\splunk_private_db\snapshot.old: Access is denied. 

Anyone know what file and setting I should be looking at for the fix? It seems like a authentication.conf (I'm setup for LDAP authentication) setting reference and just wanted an opinion. Thanks.



could it be that you are running the forwarder as a non-privileged user? If so, you could change the ownership of the splunkhome\var directory tree to the splunk user.


0 Karma


I have the same issue with my account. I'm trying to change the authentication.conf file to include some group mappings and it says I can't save. I am administrator on this is it because the service is still running?

0 Karma


Hello @cjsweeney1

It seems the account Splunk is being run in the Windows Server does not have the admin privileges to remove the snapshot,old file from the location.

Once the privileges are updated, Splunk would have permission to edit the file and rename it to what is required.

We had this addressed by ensuring the permissions splunk is using in the host are updated.

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...