I'm currently building my own home instance and I'm having some trouble with my UF. So far I've : installed the latest / correct version for my Ubuntu - Linux system sudo chown -RP splunk:splunk /opt/splunkforwarder/ searched through SplunkForwarder.service to see if the correct user is applied (which it is) tried re-installing and running ./splunk enable boot-start as splunk user, and as root. When using the splunk user, I have to authenticate as root anyway but i get the same results for both ./splunk start results in "Done" after authentication ./splunk status results in: Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk:splunkfwd /opt/splunkforwarder" Couldn't change ownership for /opt/splunkforwarder/etc : Operation not permitted splunkd is not running. ./splunk enable boot-start results in: " A systemd unit file already exists at path ="/etc/systemd/system/SplunkForwarder.service". To add a Splunk generated systemd unit file, run 'splunk disable boot-start' before running this command. If there are custom settings that have been added to the unit file, create a backup copy first. It seems no matter which account I use or which user has permissions, I'm unable to have access to any of the files under "/opt/splunkforwarder" nor am I able to start the UF itself or configure boot-start.
... View more