Package Details: splunk 3:9.3.1.0-1

Git Clone URL: https://aur.archlinux.org/splunk.git (read-only, click to copy)
Package Base: splunk
Description: Statistical analysis and search tool for logs and machine data
Upstream URL: https://www.splunk.com/
Licenses: custom
Submitter: lb.laboon
Maintainer: lb.laboon
Last Packager: lb.laboon
Votes: 6
Popularity: 0.000000
First Submitted: 2015-12-07 16:56 (UTC)
Last Updated: 2024-10-11 14:15 (UTC)

Latest Comments

1 2 Next › Last »

lb.laboon commented on 2024-04-02 13:58 (UTC)

@davvore33 Please see my reply to that comment. You need to create an admin user (via user-seed.conf file or one of the other methods) first before launching Splunk for the first time. I will update the post-install output to mention this on the next update.

davvore33 commented on 2024-04-02 10:06 (UTC) (edited on 2024-04-02 10:20 (UTC) by davvore33)

the problem with systemctl logged by @rabin is still there,

if you install this packet and just run "systemctl start splunk" it will mess with splunk user configuration.

the way around was to un-install and delete the entire /opt/splunk and install it back, after that i've run splunk$/opt/splunk/bin/splunk start and everything was fine

lb.laboon commented on 2022-06-20 15:43 (UTC)

As a heads-up - the latest version of Splunk (9.0.0) includes a new version of the Python Readiness app that may conflict with an already-present version while upgrading. If you run into this, add --overwrite '/opt/splunk/etc/apps/python_upgrade_readiness_app/*' to your pacman (or AUR helper) arguments.

lb.laboon commented on 2021-06-25 21:39 (UTC) (edited on 2021-06-25 22:03 (UTC) by lb.laboon)

@maverick1 I just updated and converted the package to use modern sysusers and tmpfiles for user creation. If you wanna give it another shot, it should work for you now.

If you are referring to the Splunk login credentials, you will need to create those yourself: https://docs.splunk.com/Documentation/Splunk/8.2.1/Security/Secureyouradminaccount

rabin commented on 2021-06-25 12:15 (UTC)

By starting Splunk using systemctl results in "No users exist. Please set up a user.". Nothing has worked yet.

jskier commented on 2021-01-16 19:16 (UTC)

@lb.laboon, thanks, I'll check it out.

lb.laboon commented on 2021-01-16 19:12 (UTC)

I've been hitting that as well, although I thought it might've just been me since nobody said anything :D

I did a little experimenting and I think it might be because PKGBUILDs default to stripping debug symbols from binaries, resulting in the checksums differing. I just pushed a new version which disables that.

jskier commented on 2021-01-15 21:14 (UTC)

Shouldn't newer versions overwrite existing files? I had an issue with a bundled app, splunk_secure_gateway, that had file integrity issues. The files themselves were correct, however the FI DB complained about mismatched hashes. Once I extracted the tgz manual and overwrote all files, it went away.

lb.laboon commented on 2018-09-18 18:22 (UTC)

@PhotonX

It sounds like some of the files in your installation may have gotten owned by the root user (or another non-splunk user). Try running chown -R splunk:splunk /opt/splunk and see if that fixes the issue.

PhotonX commented on 2018-09-17 11:04 (UTC)

After the update I could not log in because no users were present, so I started Splunk with

/opt/splunk/bin/splunk start

and set up the admin user.

Now I can only start with this command, trying to start using systemd gives the following errors (output of journalctl): https://pastebin.com/2y0ARUqR

Seems like a permission problem but I don't really understand what is going wrong here...

1 2 Next › Last »