Splunk Enterprise

inputs.conf access by root only??!?!

kristiaan_d
Explorer

Hi Everyone, i am having problems configuring a splunk app, here are the instructions.

  1. Configure a 'Light Weight Forwarder' on the Nagios server

    • cd $SPLUNK_HOME/bin (eg. cd /opt/splunk/bin)
    • ./splunk add monitor $NAGIOS_HOME/var/nagios.log -sourcetype nagios -hostname hostname.com Remember to replace $NAGIOS_HOME with the relevant directory (eg. /opt/nagios)
    • edit $SPLUNK_HOME/etc/apps/search/local/inputs.conf on the Nagios server and add the following key/value pair:

index = nagios

  • restart the Splunk LWF agent.

THe problem comes when i try to update the inputs.conf file, the folder this is stored in is owned by ROOT. i have tried Sudo Nano /local/inputs.conf to try and get around not being able to access the folder but nothing i do works.

how do i change this???

the linux box is running a version of Ubuntu Server, and the splunk software has just been installed and configured to run as a Light weight Forwarder.

thanks Kris

0 Karma
1 Solution

vaijpc
Communicator

Are you typing exactly

Sudo Nano /local/inputs.conf

as that won't work?

If you are in $SPLUNK_HOME/etc/apps/search (e.g. /opt/splunk/etc/apps/search) try

sudo nano local/inputs.conf

View solution in original post

0 Karma

vaijpc
Communicator

Are you typing exactly

Sudo Nano /local/inputs.conf

as that won't work?

If you are in $SPLUNK_HOME/etc/apps/search (e.g. /opt/splunk/etc/apps/search) try

sudo nano local/inputs.conf
0 Karma

vaijpc
Communicator

You may be interested to know that it works in the same way on Windows. Start a path with '\' on windows, or '/' on linux and it will think you want to start at the 'root' of the drive'. I'm afraid it was only doing what you told it to do 🙂

0 Karma

kristiaan_d
Explorer

😄 that sorted it, seems linux was taking offence to me putting in the / on /local/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...