Getting Data In

How does the user:group get set for a deployed app to the universal forwarder?

fblau
Explorer

When I deploy an app to my universal forwarder, it has root:root ownership. Is there any way to set that to another user that is better suited to running on the forwarder?

esix_splunk
Splunk Employee
Splunk Employee

Permissions are retained from Unix to Unix hosts, and Windows to Windows hosts.

However a Linux DS deploying to Windows, and vice-a-versa, a Windows DS deploying to Linux will not retain permissions file system permissions.

This typically is only a problem in the *Nix world, where you're running your DS as 'splunk' or a non-root id, and you actually want it to be root or a different uid on the client.

In the case where you are deploying to different OS's, it's better to setup a script to chown the $splunk_home$/etc/apps and run that frequently as you need to.

Windows works a bit differently, as you can setup the filesystem to inherit from the parent folder and this typically works as designed.

woodcock
Esteemed Legend

it makes a HUGE difference if your DS is Windows or Linux so which is it? If it is Linux, the permissions should be preserved but if your DS is Windows and your DC is Linux, you may be in for trouble; the last time I tried that I could not make it work but it was V5...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...