fresh splunk installation, acccept license gives warning

[inventsekar]

Hi there, 

On a windows desktop, installed a virtualbox and ubuntu 24 and downloaded splunk 10.2.3 using the deb package
The installation went fine, but when i start _accept-license, it given a strange error:

ubuntu@ubuntu:/opt/splunk$ /opt/splunk/bin/splunk start --accept-license
Warning: cannot create "/opt/splunk/var/log/splunk"
Warning: cannot create "/opt/splunk/var/log/introspection"
Warning: cannot create "/opt/splunk/var/log/watchdog"
Warning: cannot create "/opt/splunk/var/log/client_events"
Warning: cannot create "/opt/splunk/etc/licenses/download-trial"
ubuntu@ubuntu:/opt/splunk$

[CraigS]

At present, this can be worked around to run as root using command:

sudo $SPLUNK_HOME/bin/splunk start --accept-licence --run-as-root

Which is noted in the error, along with this is being deprecated soon requiring non-root user to run services.

Better practice is running as Splunk user with limited permissions as @inventsekar did get to; which is documented here (10.2 docs).

The shorthand command noted in answer of

sudo -i -u splunk $SPLUNK_HOME/bin/splunk start --accept-license

starts Splunk within the OS Splunk user context for one-time operation, rather than trying to run as the root user. 

Going a step further boot-start can be enabled within the OS Splunk user context also:

sudo $SPLUNK_HOME/bin/splunk enable boot-start -user splunk

Reference here (10.2 docs) .

[inventsekar · Accepted solution]

troubleshooting steps followed:

1) to make sure enough space, checked the filesystem looked fine (df -h)
2) checked the /opt/splunk folder owner(is it splunk or root)

ubuntu@ubuntu:/opt/splunk$ ll
total 6384
drwxr-xr-x 12 splunk splunk    4096 May  6 03:56 ./
drwxr-xr-x  4 root   root      4096 May  6 03:39 ../
-r--r--r--  1 splunk splunk     520 Apr 13 17:12 README-splunk.txt
drwxr-xr-x  3 splunk splunk   12288 May  6 03:50 bin/
-r--r--r--  1 splunk splunk      57 Apr 13 17:02 copyright.txt
drwxr-xr-x 17 splunk splunk    4096 May  6 03:50 etc/
-rw-r--r--  1 splunk splunk     426 May  6 03:50 ftr
drwxr-xr-x  4 splunk splunk    4096 May  6 03:49 include/
drwxr-xr-x  9 splunk splunk    4096 May  6 03:50 lib/
-r--r--r--  1 splunk splunk   59708 Apr 13 17:02 license-eula.txt
drwxr-xr-x  2 splunk splunk    4096 May  6 03:50 openssl/
drwxr-xr-x  8 splunk splunk    4096 May  6 03:48 opt/
drwxr-xr-x  2 splunk splunk    4096 May  6 03:50 quarantined_files/
drwxr-xr-x  5 splunk splunk    4096 May  6 03:50 share/
-r--r--r--  1 splunk splunk 6402399 Apr 13 17:51 splunk-10.2.3-4d61cf8a5c0c-linux-amd64-manifest
drwxr-xr-x  2 splunk splunk    4096 May  6 03:50 swidtag/
drwx--x---3 splunk splunk    4096 May  6 03:56 var/
ubuntu@ubuntu:/opt/splunk$

i remember two folders(../ and var/) are owned by root. 
so i ran "sudo chown -R splunk:splunk /opt/splunk

3) then i try to do the accept license, but still the same warning. 
4) then i tried to accept license with root, but got the error:

ubuntu@ubuntu:/opt/splunk$ sudo /opt/splunk/bin/splunk start --accept-license
[sudo: authenticate] Password:
Running Splunk Enterprise as root is deprecated and will be removed in a future release. For details, see the Release Notes. To run as root, use the --run-as-root option.
ubuntu@ubuntu:/opt/splunk$ 
5) then ran it as splunk user, it went fine:
sudo -i -u splunk /opt/splunk/bin/splunk start -accept_license

buntu@ubuntu:~$ sudo -i -u splunk /opt/splunk/bin/splunk start --accept-license

This appears to be your first time running this version of Splunk.

Splunk software must create an administrator account during startup. Otherwise, you cannot log in.
Create credentials for the administrator account.
Characters do not appear on the screen when you type in credentials.

Please enter an administrator username: admin
Password must contain at least:
* 8 total printable ASCII character(s).
Please enter a new password:
Please confirm new password:
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'.
writing RSA key

writing RSA key

Moving '/opt/splunk/share/splunk/search_mrsparkle/modules.new' to '/opt/splunk/share/splunk/search_mrsparkle/modules'.

Splunk> The Notorious B.I.G. D.A.T.A.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Creating: /opt/splunk/var/lib/splunk
Creating: /opt/splunk/var/run/splunk/appserver/i18n
Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css
Creating: /opt/splunk/var/run/splunk/upload
Creating: /opt/splunk/var/run/splunk/search_telemetry
Creating: /opt/splunk/var/run/splunk/search_log
Creating: /opt/splunk/var/spool/splunk
Creating: /opt/splunk/var/spool/dirmoncache
Creating: /opt/splunk/var/lib/splunk/authDb
Creating: /opt/splunk/var/lib/splunk/hashDb
Creating: /opt/splunk/var/run/splunk/collect
Creating: /opt/splunk/var/run/splunk/sessions
New certs have been generated in '/opt/splunk/etc/auth'.
New certs have been generated in '/opt/splunk/etc/auth'.
Checking critical directories... Done
Checking indexes...
Validated: _audit _configtracker _dm_summary _dsappevent _dsclient _dsphonehome _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-10.2.3-4d61cf8a5c0c-linux-amd64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Using configuration from /opt/splunk/share/openssl3/openssl.cnf
..+.+.........+.....+...............+.+.........+.....+.........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...........+...............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.....+.+.....+..........+......+.....+..........+.....+.........+....+...+..+.+..+.........+.........+.+...+.....+.+..............+......+......+.+.....+.........................+........+.......+...+..+.........+..........+...+........+...+......+....+.....+.+.....+...+.+..+.......+...+...............+...+..+...+....+...+...+......+...+..+..........+......+..+...+.......+..+.+...............+..+...+...+.+..................+..+....+.................+....+...+.....+......+.+...+...+.........+........+......+.........+..........+...+.....+...+.......+...+.........+..+....+.........+...........+.+...............+...+...........+.........+.+..+....+........+.......+..............+.......+..+...+..................+....+..................+..+............+.+........+....+.....+...+...+.+.....+.+...........................+.....+.......+......+..............+.........+.......+.........+...........+...+....+..+.............+..+.+............+..+....+......+...+...+.....+.........+....+............+.....+..................+.+...+...+.....+...+....+..+.............+.....+......+.+......+..+.+..+...+..........+......+..................+...+..+..........+..+....+.....+..........+.........+..+...+.......+........+.+.........+....................+......+.+...+.....+......+.+......+...+..+.............+..+.............+.....+.......+............+...+...+.....+................+...+..+......+...+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
.+..+.+......+...........+...+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+..+.............+..+....+...+..+....+..+...+.+...+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+......+.....+.+......+..+.+......+......+.......................+......+....+..+...+....+......+.........+..+...+...+.......+...+...+......+...+...+.........+.......................+...+...............+...+......+...+.+..+...............+...+.+..............+.+...+...........+......+..........+...+..+.........+....+...........+....+..+.+.....+...................+...+...+..+...+.........+...+.+......+........+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Warning: ignoring -extensions option without -extfile
Certificate request self-signature ok
subject=CN = ubuntu, O = SplunkUser
Done

Waiting for web server at http://127.0.0.1:8000 to be available.......................................................................................................... Done

If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://ubuntu:8000

ubuntu@ubuntu:~$

Special thanks to James Hodgkinson, MrCraig and Martin Ommerle for their suggestions on the slack, much appreciated. 

[scelikok]

Hi @inventsekar ,

You should run installation using root user.

Best Regards,

[inventsekar]

Hi @scelikok accept-license as root given error, as mentioned in my other reply, thanks.