systemd is a system startup and service manager that is widely deployed as the default init system on most major Linux distributions. You can configure systemd to manage processes, such as splunkd, as services, and allocate system resources to those processes under cgroups.

You can use either of the following two methods to configure systemd to manage splunkd as a service:

• Configure systemd using enable boot-start.
• Configure systemd manually.

You can configure systemd to manage splunkd as a service using the enable boot-start command, as follows:

1. Log into the machine on which you want to configure systemd to manage splunkd as a service.
2. Stop splunkd.

   $SPLUNK_HOME/bin/splunk stop
   

3. If you previously enabled Splunk Enterprise to start at boot using the enable boot-start command, run disable boot-start to remove the splunk init script located in /etc/init.d and its symbolic links.

   [sudo] $SPLUNK_HOME/bin/splunk disable boot-start
   

   For instructions on how to reinstall the splunk init script, see Install splunk init script.

4. Run the enable boot-start command, specifying the -systemd-managed, -user, and -group parameters, as follows:

   [sudo] $SPLUNK_HOME/bin/splunk enable boot-start -systemd-managed 1 -user <username> -group <groupname>
   

   Note: Specifying -user and -group is optional but recommended. If you do not specify -user, the SPLUNK_OS_USER in splunk-launch.conf is used. If SPLUNK_OS_USER is not defined, the owner of the splunk binary is used.

   This installs the systemd service unit file for cgroups v2, named Splunkd.service by default, in /etc/systemd/system. For example:

   #This unit file replaces the traditional start-up script for systemd
   #configurations, and is used when enabling boot-start for Splunk on
   #systemd-based Linux distributions.
   
   [Unit]
   Description=Systemd service file for Splunk, generated by 'splunk enable boot-start'
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   Type=simple
   Restart=always
   ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd
   KillMode=mixed
   KillSignal=SIGINT
   TimeoutStopSec=360
   LimitNOFILE=65536
   LimitRTPRIO=99
   SuccessExitStatus=51 52
   RestartPreventExitStatus=51
   RestartForceExitStatus=52
   User=splunk
   Group=splunk
   Delegate=true
   CPUWeight=100
   MemoryMax=8036175872
   PermissionsStartOnly=true
   ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/system.slice/%n"
   
   [Install]
   WantedBy=multi-user.target
   

   Note: By default, the MemoryMax value is set to the total system memory available in bytes when the service unit file is created. The MemoryMax value will not update if the total available system memory changes. To update the MemoryMax value in the unit file, you must manually edit the value or use the boot-start command to disable and re-enable systemd.
   CAUTION: The following unit file properties are required. Do not change these values without appropriate guidance.

   • Type=simple
   • Restart=always
   • ExecStart=$SPLUNK_HOME/bin/splunk _internal_launch_under_systemd
   • Delegate=trueThis property is required for workload management. See Configure workload management
   CAUTION: Do not use the following properties. These properties can cause splunkd to fail on restart.

   • RemainAfterExit=yes

   • ExecStop

   For more information, see Systemd unit file properties.

5. Start splunkd.

   [sudo] $SPLUNK_HOME/bin/splunk start
   

   This starts splunkd as a systemd service.

   Note: Under systemd, splunk start|stop|restart commands are mapped to systemctl start|stop|restart commands.
6. Verify that splunkd is running as a systemd service. For example:

   $SPLUNK_HOME/bin/splunk status
   splunkd is running (PID: 24772).
   splunk helpers are running (PIDs: 24843 24857 24984 25032).
   

   Note: Alternatively, you can use systemctl status to check if the splunkd process is running. However, when using this command, a brief time lag can occur during which systemctl status shows "active" and splunk status shows "splunkd is not running".
7. For distributed deployments, repeat steps 1-6 on all search heads and indexers.

The enable boot-start command supports these additional options:

To configure systemd on a clean installation of Splunk Enterprise:

1. Expand the install package in an appropriate directory. For example:

   tar xvfz splunk_package_name.tgz -C /opt
   

2. Run enable boot-start to install the Splunkd.service unit file:

   sudo $SPLUNK_HOME/bin/splunk enable boot-start -systemd-managed 1 -user <username>
   

   Note: When running enable boot-start for the first time after a clean install, Splunk Enterprise prompts you to accept the Splunk software license agreement. To automatically accept the license without prompt, specify the --accept-license flag with the command.
3. Start splunkd.

   sudo $SPLUNK_HOME/bin/splunk start 
   

4. Verify that splunkd is running as a systemd service.

   $SPLUNK_HOME/bin/splunk status
   

When managing an indexer cluster under systemd:

• You must use the sudo command to start, stop, and restart the cluster manager node or individual peer nodes using splunk start|stop|restart commands.
• You do not need sudo to perform a rolling restart using the splunk rolling-restart cluster-peers command, or to take a peer offline using the splunk offline command.

When managing a search head cluster under systemd:

• You must use the sudo command to start, stop, and restart cluster members using splunk start|stop|restart commands.
• You do not need sudo to perform a rolling restart using the splunk rolling-restart shcluster-members command, or to remove a cluster member using the splunk remove shcluster-members command.