I have installed the forwarder in /opt/splunkforwarder
and run the splunk start
command. I get the license to read/accept, but when I accept the license I get the following message:
This appears to be your first time running this version of Splunk.
Could not open log file "/opt/splunkforwarder/var/log/splunk/first_install.log" for writing (2).
When I check the splunkforwarder directory, there is no var folder...
Any help would be appreciated.
Dave
satishsdange gravatar image satishsdange · 3 days ago 1
I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux
Add your comment...
jterry gravatar image jterry [Splunk] satishsdange · 2 days ago
yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.
Add your comment...
jbailey_splunk gravatar image jbailey [Splunk] jterry · 3 hours ago
From /opt, run "chown -R : splunkforwarder" (to change ownership)
Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder)
- being the user that should own these files and directories
- being the group assigned to the user
Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.
If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder
Hope this helps...
I am suspecting a permission issue with your instance. Please refer to below link -
http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux
yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably.
From /opt, run "chown -R : splunkforwarder" (to change ownership)
Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder)
- being the user that should own these files and directories
- being the group assigned to the user
Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories.
If you used an rpm to install, the user and group should be splunk, so an example would be:
cd /opt
chown -R splunk:splunk splunkforwarder
chmod -R 744 splunkforwarder
Hope this helps...