We are running Splunk on Windows 2012 with 'service accounts' (sa_splunkd_idx1) . Executing an update (indexer) from 6.1.x to 6.4.1, we are trying to make sure that the permissions are OK for the update. We're stuck on the ICACLS command below, dozens of '.bucketManifest*' files we can't change and the update fails. Any Idea why we can't change the permission?
As administrator:
C:ICACLS "D:\Program Files\Splunk" /grant sa_splunkd_idx1$:F /T /Q
D:\Program Files\Splunk\var\lib\splunk\defaultdb\db\.bucketManifest1296_649836405_tmp: Access is denied.
Successfully processed 10910 files; Failed processing 1 files
The next commands to update:
msiexec.exe /i \\host5a01\Softwarearchive\Software\SPLUNK\splunk-6.4.1-debde650d26e-x64-release.msi LOGON_USERNAME="voip\sa_splunkd_idx1$" INSTALLDIR="D:\Program Files\Splunk" LAUNCHSPLUNK=0 INSTALL_SHORTCUT=0 AGREETOLICENSE=Yes /passive /lv \\host5a01\Softwarearchive\SPLUNK\InstalLog641\splunkInstall-host5c02.log
pause
ICACLS "D:\Program Files\Splunk" /grant sa_splunkd_idx1$:F /T /Q
↧