check the permissions on the log files which are configured on Splunk



Is there any way to find the file permissions for any file which is configured in Splunk.
Let's say, a file has the 750 permission with root user etc.

Tags (1)
0 Karma


This should work. I haven't yet updated it to state Splunk 7.x compatible, however it should really work on any version of Splunk. Please note you have to set the execute bit on the .sh file after installing to deployment-apps on your deployment server.

Check Log Permissions Technology Add-on

0 Karma

Super Champion

I assume; mean when you "configured on Splunk" means files to be read by Splunk agent? If yes, the best way is to create a group (eg logger) and ensure splunk is member of the group logger and the file to have permission of logger . Something of below format

rwxr----- root logger   /var/log/syslog/somefile.log

This way, the file can be owned by any other user, but splunk should be able to read the file

In Linux, you could do a bulk level check of file permissions. So the below will find ALL files, with pattern of *.log in /var/log and do list of files with permissions

find /var/log -type f -name '*.log' -exec ls -l {} \; 


0 Karma

Super Champion

Hi @Allampally,

The best way to go about this is to build a scripted input to read ls -lhon your files.

You would then be able to keep a history of changes of permissions on any files/directory you choose to monitor. Let me know if you need an example of how to build one.


0 Karma


Could you please provide an example

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...