Splunk Dev

When I try to start Splunk after untarring, I get the error "Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC"

LukeMurphey
Champion

After untarring a download of Splunk in tar.gz format, I get the following error:

ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment 

What is the cause of this?

Tags (1)
0 Karma
1 Solution

LukeMurphey
Champion

This happens when you attempt to run Splunk under a non-root user after untarring using sudo or as the root user. The user ID and group ID is set in the tar file based on the user/group of the Splunk build server that built it. If you look at the user ID and group ID of the tar file after extraction, you will see that it sets a user ID and a group ID of 506 for both.

You can avoid this issue by either:

  1. Using the -o flag to have the tar command use the user ID and the group ID of the current user
  2. Not untarring via sudo or using the root account (tar needs superuser permission to change the user and group permission so running as a non-superuser means it won't change the user and group)

View solution in original post

LukeMurphey
Champion

This happens when you attempt to run Splunk under a non-root user after untarring using sudo or as the root user. The user ID and group ID is set in the tar file based on the user/group of the Splunk build server that built it. If you look at the user ID and group ID of the tar file after extraction, you will see that it sets a user ID and a group ID of 506 for both.

You can avoid this issue by either:

  1. Using the -o flag to have the tar command use the user ID and the group ID of the current user
  2. Not untarring via sudo or using the root account (tar needs superuser permission to change the user and group permission so running as a non-superuser means it won't change the user and group)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...