Splunk Enterprise

i installed splunk forwarder and tried to run below command : ./splunk enable boot-start --accept-license. I got below error: Can't create RC file "/etc/init.d/splunk": Permission denied. Is there a way that the RC file is created in some different path.

raghavjha73
New Member

i installed splunk forwarder and tried to run below command : ./splunk enable boot-start --accept-license.

I got below error:
This appears to be your first time running this version of Splunk.
Can't create RC file "/etc/init.d/splunk": Permission denied

Is there a way that the RC file is created in some different path because i don't have access to add/modify any files in /opt or /etc folder.

Tags (1)
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You need to run this as root, or sudo run this command, because to modify /etc/init.d, you need admin / root privileges. Additionally you need to specify the run-as user:

./splunk enable boot-start --accept-license  -user splunk

So if you run the above as root, and substitute splunk with the username of the service account you want to Splunk to run as, then you should be ok.

Additionally, before finalizing this, you should change the ownership of /opt/splunk to the user designated... Do a service splunk stop and then :

chown -R splunk:splunk /opt/splunk

After that, you can start splunk via the service command, or sudo to the user you specified and start it that way. Do not start Splunk as root, or any other user. It will screw with permissions and throw errors.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!