Hi , i have an issue our one of indexer goes down because it says unable to start because splunk is unable to read the file from following location. Please check the permissions.
Is it really a permission issue if splunk is unable to read a file from a directory ?
Did you install Splunk as root and are trying to start it with another user now? Are all files owned by the correct user? Without further information, we can only guess.
Skalli
We need to make sure that the permissions are given for the splunk user and splunk is running as a splunk user rather than a root user.
Hello @Prakash493
Did you install Splunk as root and are trying to start it with another user now? Are all files owned by the correct user? Without further information, we can only guess.
Skalli
Yes installed by admin and i am user but before i am able to start and stop not now
Correct i changed as a user and performed as root and everythink works fine
If Splunk was started as root at any time, some files will now belong to root, and you will have to chown everything in the Splunk install directory back to the user that is supposed to own it.