When running trying to run a search via the CLI (Redhat Linux) I get the following message:
"Splunk is not running, and it must be for this operation. To start splunk, run "splunk start"."
However the Splunk is up and running and fully functional via the Webgui. Any ideas on how to get this working?
Splunk may be running but maybe not the installation-instance that you think. Use your favorite method to determine the full path of the currently running splunkd
process and make sure you call splunk
in that path.
Started by root
Ownership of $SPLUNK_HOME/var/run/splunk is root
Have there been any recent configuration changes to Splunk? Which account started Splunk? Which account owns the files in $SPLUNK_HOME/var/run/splunk?