When I try to start Splunk after untarring, I get the error "Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC"

[LukeMurphey]

After untarring a download of Splunk in tar.gz format, I get the following error:

ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment 

What is the cause of this?

[LukeMurphey · Accepted solution]

This happens when you attempt to run Splunk under a non-root user after untarring using sudo or as the root user. The user ID and group ID is set in the tar file based on the user/group of the Splunk build server that built it. If you look at the user ID and group ID of the tar file after extraction, you will see that it sets a user ID and a group ID of 506 for both.

You can avoid this issue by either:

1. Using the -o flag to have the tar command use the user ID and the group ID of the current user
2. Not untarring via sudo or using the root account (tar needs superuser permission to change the user and group permission so running as a non-superuser means it won't change the user and group)