Deployment Architecture

permission denied error while applying cluster bundle from cluster master to slave indexers

abhinav_maxonic
Path Finder

I add stanzas to indexes.conf and props.conf in cluster-master at location : /opt/splunk/etc/master-apps/_cluster/local/ .
After making the changes I tried applying bundle.

[root@machine1 bin]# ./splunk apply cluster-bundle
 Warning: Under some circumstances, this command will initiate a rolling restart of all peers. This depends on the contents of the configuration bundle. For details, refer to the documentation. Do you wish to continue? [y/n]: y
Splunk username: admin
Password:
Can't write file "/root/.splunk/authToken_machine1_8089": Permission denied
  1. Whats the solution to this error ?
  2. Why am I getting this error ?
  3. Is there way around, other than doing it manually on each indexer ?
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

This is occuring because you are running this command as root, and not as the splunk user.

sudo su - splunk

And then rerun the command. This is doing this because Splunk doesnt have permissions to write the authentication token to the /root home directory, since splunk isnt running as a root user.

View solution in original post

goelli
Communicator

Either run the command as the same user as Splunk runs:

sudo -u splunk_user /path/to/splunk command

Or do the following for every user you want to run the commands (you have to insert the hostname and the mgmt port of your Splunk instance):

cd ~
mkdir .splunk
chmod 777 -R .splunk
touch .splunk/authToken_hostname_port
chmod 600 .splunk/authToken_hostname_port
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

This is occuring because you are running this command as root, and not as the splunk user.

sudo su - splunk

And then rerun the command. This is doing this because Splunk doesnt have permissions to write the authentication token to the /root home directory, since splunk isnt running as a root user.

craigv_splunk
Splunk Employee
Splunk Employee

Make sure your pass4SymmKey is properly configured and contains the same value across the infrastructure

https://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Configurepeerswithserverconf

abhinav_maxonic
Path Finder

Yeah. pass4SymmKey is different on all the indexers and cluster master. Will change them and will keep it same for cluster master and all slave indexers. And will test then.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...