satishsdange gravatar image satishsdange · 3 days ago 1
I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux
Add your comment...
jterry gravatar image jterry [Splunk] satishsdange · 2 days ago
yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.
Add your comment...
jbailey_splunk gravatar image jbailey [Splunk] jterry · 3 hours ago
From /opt, run "chown -R : splunkforwarder" (to change ownership)
Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder)
- being the user that should own these files and directories
- being the group assigned to the user
Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.
If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder
Hope this helps...
... View more