With polkit versions 0.120 and below, the version number was structured with a major/minor format always using the major version of 0. It appears that Splunk was using that dot between them to decode the version number in its create-polkit-rules option to detect whether the older PKLA file or the newer JS version would be supported. Starting in polkit version 121, the maintainers of polkit have dropped the "0." major number and started using the minor version as the major version. Because of this, Splunk does not currently seem to be able to deploy its own polkit rules. This affects both RHEL 9 and Ubuntu 24.04 so far in my testing. Has anyone else run into this issue or have another workaround for it? Thanks!   root@dev2404-1:~# pkcheck --version pkcheck version 124 root@dev2404-1:~# apt-cache policy polkitd polkitd: Installed: 124-2ubuntu1 Candidate: 124-2ubuntu1 Version table: *** 124-2ubuntu1 500 500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages 100 /var/lib/dpkg/status root@dev2404-1:~# /opt/splunk/bin/splunk version Splunk 9.2.1 (build 78803f08aabb) root@dev2404-1:~# /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 -create-polkit-rules 1 " ": unable to parse Polkit major version: '.' separator not found. ^C root@dev2404-1:~#     https://github.com/polkit-org/polkit/tags ... View more

I have noticed that Splunk sometimes hangs on startup in one customer's enviroment, and when it does, it seems to be trying to access a directory in /home that doesn't make much sense. Here is the behavior and where it is hanging: $ ps ax|grep splunk 32023 pts/0 S 0:00 /opt/splunk/bin/splunk start 32032 pts/0 S 0:00 python -u /opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py _py_internal check-xml-files 32055 pts/0 S+ 0:00 grep --color=auto splunk $ strace -p 32032 Process 32032 attached --- SIGCONT {si_signo=SIGCONT, si_code=SI_USER, si_pid=30777, si_uid=74782} --- stat("/home/build/build-home/kimono/lib/tls/x86_64", This seems to happen on many versions, but sometimes the directory name is different (It seems like a codename for the version). Why is Splunk trying to access /home/build on a production installation? ... View more