Getting Data In

Why am I getting a "Permission Denied" error when running './splunk list forward-server'?

srajesh82
Engager

I am trying to add the forwader or list it, but it ends up in permission denied messsage

./splunk list forward-server
Splunk username: admin
Password:
Can't create directory "/root/.splunk": Permission denied

Need your help to fix this

Tags (2)
1 Solution

srajesh82
Engager

We started the splunk instance using an service account.
But later we were trying to check the forwarder testing using root account which ends up wit above error.

we changed back to service account and it worked.

View solution in original post

goelli
Communicator

Either run the command as the same user as Splunk runs:

sudo -u splunk_user /path/to/splunk command

Or do the following for every user you want to run the commands (you have to insert the hostname and the mgmt port of your Splunk instance):

cd ~
mkdir .splunk
chmod 777 -R .splunk
touch .splunk/authToken_hostname_port
chmod 600 .splunk/authToken_hostname_port

harsmarvania57
SplunkTrust
SplunkTrust

You need to run above command with same user as splunk service is running.

nickhills
Ultra Champion

if you have used the default usernames and paths you should be able run:

sudo -u splunk /opt/splunk/bin/splunk list forward-server
If my comment helps, please give it a thumbs up!

srajesh82
Engager

We started the splunk instance using an service account.
But later we were trying to check the forwarder testing using root account which ends up wit above error.

we changed back to service account and it worked.

harsmarvania57
SplunkTrust
SplunkTrust

Can you please let us know from which users you are trying to run above command? And from which user, splunk service is running??

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...