After untarring a download of Splunk in tar.gz format, I get the following error:
ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment
What is the cause of this?
This happens when you attempt to run Splunk under a non-root user after untarring using sudo or as the root user. The user ID and group ID is set in the tar file based on the user/group of the Splunk build server that built it. If you look at the user ID and group ID of the tar file after extraction, you will see that it sets a user ID and a group ID of 506 for both.
You can avoid this issue by either:
This happens when you attempt to run Splunk under a non-root user after untarring using sudo or as the root user. The user ID and group ID is set in the tar file based on the user/group of the Splunk build server that built it. If you look at the user ID and group ID of the tar file after extraction, you will see that it sets a user ID and a group ID of 506 for both.
You can avoid this issue by either: