Deployment Architecture

Search Head Deployer create .splunk folder in home directory

vicvaughan
Explorer

When pushing a shcluster bundle as our sudo splunk user, I got the following message:

Can't create directory "/home//.splunk": Permission denied

I was able to mod the directory so it could create .splunk, but my question is why is it creating that in my home folder?

(I was not in my home folder when the push command was run and I was using the absolute path to the bundle push command)

Thanks, all!

0 Karma
1 Solution

masonmorales
Influencer

When you run a Splunk command that requires authentication, Splunk creates an auth token in ~/.splunk on whichever user you ran the command on. The token contains a username and session key that Splunk uses to re-authenticate itself in case you need to run additional CLI commands. This is usually not a problem if you run Splunk CLI commands from the same user that Splunk runs as.

View solution in original post

0 Karma

masonmorales
Influencer

When you run a Splunk command that requires authentication, Splunk creates an auth token in ~/.splunk on whichever user you ran the command on. The token contains a username and session key that Splunk uses to re-authenticate itself in case you need to run additional CLI commands. This is usually not a problem if you run Splunk CLI commands from the same user that Splunk runs as.

0 Karma

jaihingorani
Path Finder

Are there any security related concerns due to this , as this file contains the authToken ? Can this be miss used  in any possible way?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...