Deployment Architecture

Splunk package error

automagication
Engager

Whenever I package the splunk app, I get execute permission error because I have 744 permission for conf files but splunk expects it to be 644.

With 644 permission I cannot package the app, is there any workaround for the same.

Below is the screenshot of the error.

automagication_0-1714658217568.png

 

Labels (1)
Tags (2)
0 Karma

automagication
Engager

Even untar and tar with different permissions, will not let me package because the permissions are 644, there is no execute permission

0 Karma

automagication
Engager
0 Karma

automagication
Engager

No I use Linux ubuntu wsl on windows, I can set permissions correctly but the problem is with 644 permissions, I cant run slim package app-folder

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ubuntu on Windows is still Windows.  I had the same problem.  You have to use a real Linux box.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm guessing you're packaging the app on a Windows machine.  That will never work because Windows can't/won't set the file permissions correctly.  When I used to package on Windows, I would transfer the .tgz file to a Linux system, explode it, change the permissions, then re-tar it and transfer back to the Windows machine for uploading.

---
If this reply helps you, Karma would be appreciated.
0 Karma

automagication
Engager

 I don't think this is the issue, I am  using linux

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...