We encountered an error after we upgraded to a new version of Splunk. This Splunk instance is under a distributed environment and this is one of the indexers within a cluster. Please see the logs below after we run ./splunk status :
Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied: '/opt/splunk/etc/system/local /migration.conf'Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1359, in <module>
sys.exit(main(sys.argv))
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1212, in main
parseAndRun(argsList)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1067, in parseAndRun
retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 293, in call
return self.func(args, fromCLI)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/control_api.py", line 35, in wrapperFunc
return func(dictCopy, fromCLI)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/_internal.py", line 189, in firstTimeRun
migration.autoMigrate(args[ARG_LOGFILE], isDryRun)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3166, in autoMigrate
checkTimezones(CONF_PROPS, dryRun)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 411, in checkTimezones
migSettings = comm.readConfFile(PATH_MIGRATION_CONF)
File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli_common.py", line 172, in readConfFile
f = open(path, 'rb')
PermissionError: [Errno 13] Permission denied: '/opt/splunk/etc/system/local/migration.conf'Please file a case online at http://www.splunk.com/page/submit_issue
We also tried the "chown" command but still no luck.
try to change ownership to entire Splunk directory, not only to specific folder and then try to restart Splunk and verify. Make sure you change ownership to right user, I just gave <user> as example below
Eg: If splunk is installed in location - /opt/splunk
- Go to /opt directory
- run command --> sudo chown -R user:user splunk
- Restart splunk
Hope this helps !!! Good luck