Hi there! I was trying to access log files from a remote drive. After failing to index any content from the directory on the network, I then tried to run services "Splunkd" and "Splunkweb" as a user with the access to the remote drive.
After restarting the services, I encountered following error while starting Splunk:
IOError: [Errno 13] Permission denied: 'C:\Program Files\Splunk\var\run\splunk\session-a22699a0d534352c044d5ba6c1f30753cbe4bb71.lock'
I have checked this thread: http://www.splunk.com/support/forum:SplunkGeneral/3163
while gkanapathy stated at last that "I will note that if you change the userid of the splunkweb and splunkd services, you will probably encounter a bunch of file permissions and access problems on the local Splunk installation (e.g., can't get to it's own program and config and temp files), and you'd have to go and change all those."
I am wondering which exactly changes can be applied according to this scenario?
Thanks a lot in advance.
Have you tried deleting the lock file? It just locks the session, if Splunk doesn't have access to it then it won't be able to remove it.
Essentially you need the user that is running splunk to be able to have access to all of the splunk configs inside splunk\etc\apps and splunk\etc\system.
That would mean changing them to the user that you are running Splunk as.
You could also change the permission to the lock file to the current user to allow it access to handle it itself.
Have you tried deleting the lock file? It just locks the session, if Splunk doesn't have access to it then it won't be able to remove it.
Essentially you need the user that is running splunk to be able to have access to all of the splunk configs inside splunk\etc\apps and splunk\etc\system.
That would mean changing them to the user that you are running Splunk as.
You could also change the permission to the lock file to the current user to allow it access to handle it itself.
Thanks very much for the kind help =D
Right click on the file, properties, click on the Security tab at the top, click edit, from here you can modify the permissions of existing users or add users
Be careful about playing around with existing permissions unless its to provide a specific user with permission to a file.
Bear in mind that groups can be on here so you could accidentally give a group full permissions instead of a user if they have similar names 🙂
Thanks a lot, deleting the lock file does fix this issue. But, how do I change the permission to the lock file to the current user?