I am trying to determine why I am seeing the following error upon reloading the deployment server:
" An error occurred: Could not create Splunk settings directory at '/root/.splunk' "
I think my permissions are correct, but I'm not sure Splunk should be able to write to /root. I was able to find a .splunk hidden file, but it is in my service account's home directory. I am not finding a lot of documentation on the "Splunk settings directory" and how to designate where to place the file - my thought is that this SHOULD be in the home directory rather than root.
I've considered creating a .splunk folder in root owned by my service account but wasn't sure what the far reaching consequences might be.
Little more info on my setup:
I did see similar trouble reported, but none answering the question of how to configure a different location for the Splunk settings directory:
https://answers.splunk.com/answers/211892/could-not-create-splunk-settings-directory-at-root.html
https://answers.splunk.com/answers/323198/command-for-reloading-the-deployment-server-with-s.html
This trouble was related to partial LDAP configuration. Even though we were using local Splunk credentials (not tied to the LDAP configuration) on the box, it seems the command was reaching out to the AD server and oddly providing the aforementioned error.
This trouble was related to partial LDAP configuration. Even though we were using local Splunk credentials (not tied to the LDAP configuration) on the box, it seems the command was reaching out to the AD server and oddly providing the aforementioned error.