Splunk Search

Can't unlink pid file "/Applications/Splunk/var/run/splunk/splunkd.pid": Permission denied

TheJagoff
Communicator

Splunk Free Enterprose download.

Trying to start Splunk - non-root user. To "Start and Show Plunk" I get the error: Can't unlink pid file "/Applications/Splunk/var/run/splunk/splunkd.pid": Permission denied.

Changed it to 755 via sudo chmod 755 splunkd.pid and I try to restart, get the same error

Running MACPRO Mavericks.

Any help is greatly apprciated

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi TheJagoff,

you need to chown the /Application/Splunk directory to the non-root user after you stopped splunk. Try this in a terminal as the non-root user:

sudo chown -R non-root-user /Application/Splunk
/Application/Splunk/bin/splunk start

You also need to modify the /Application/Splunk/etc/splunk-launch.conf file to set the userid which runs splunk.
Hope this helps ...

cheers, MuS

View solution in original post

grijhwani
Motivator

You'll get this as a consequence of running splunk as root, or as a bootable service.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi TheJagoff,

you need to chown the /Application/Splunk directory to the non-root user after you stopped splunk. Try this in a terminal as the non-root user:

sudo chown -R non-root-user /Application/Splunk
/Application/Splunk/bin/splunk start

You also need to modify the /Application/Splunk/etc/splunk-launch.conf file to set the userid which runs splunk.
Hope this helps ...

cheers, MuS

TheJagoff
Communicator

Worked perfectly! Many thanks!

0 Karma

MuS
SplunkTrust
SplunkTrust

you're welcome - please accept the answer in this case.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...