There are two ways to configure systemd to manage splunkd as a service:

• Configure systemd manually.
• Configure systemd automatically using the splunk enable boot-start command.

Follow these steps to configure systemd to manage splunkd as a service:

1. Confirm that your Linux machine is running systemd. See Is Linux running systemd?.
2. Before you create, delete, or modify the systemd unit file, you must stop splunkd.

   $SPLUNK_HOME/bin/splunk stop
   

3. If you enabled Splunk software to start at boot using enable boot-start, run disable boot-start to remove the splunk init script from /etc/init.d and its symbolic links.

   sudo $SPLUNK_HOME/bin/splunk disable boot-start
   

4. Open the $SPLUNK_HOME/etc/splunk-launch.conf file and note the value of SPLUNK_SERVER_NAME. The default value is Splunkd.
5. In the /etc/systemd/system directory, create a unit file (text file) named <SPLUNK_SERVER_NAME>.service, such as Splunkd.service.
   Note: You can change the SPLUNK_SERVER_NAME to any name you choose by directly editing the splunk-launch.conf file.
6. Add one of the following sets of properties to the <SPLUNK_SERVER_NAME>.service unit file, depending on whether your Linux system uses cgroups v1 or cgroups v2:

   For cgroups v1:

   [Unit]
   After=network.target
   
   [Service]
   Type=simple
   Restart=always
   ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd
   KillMode=mixed
   KillSignal=SIGINT
   TimeoutStopSec=360
   LimitNOFILE=65536
   SuccessExitStatus=51 52
   RestartPreventExitStatus=51
   RestartForceExitStatus=52
   User=splunk
   Group=splunk
   Delegate=true
   CPUShares=1024
   MemoryLimit=<total_available_system_memory>
   PermissionsStartOnly=true
   ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
   ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"
   
   [Install]
   WantedBy=multi-user.target
   

   Note: The MemoryLimit value is set to the total available system memory in bytes. The MemoryLimit value does not update if the total available system memory changes. To update the MemoryLimit value, you must manually edit the unit file and run the systemctl daemon-reload command to reload systemd.

   For cgroups v2:

   #This unit file replaces the traditional start-up script for systemd
   #configurations, and is used when enabling boot-start for Splunk on
   #systemd-based Linux distributions.
   
   [Unit]
   Description=Systemd service file for Splunk, generated by 'splunk enable boot-start'
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   Type=simple
   Restart=always
   ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd
   KillMode=mixed
   KillSignal=SIGINT
   TimeoutStopSec=360
   LimitNOFILE=65536
   LimitRTPRIO=99
   SuccessExitStatus=51 52
   RestartPreventExitStatus=51
   RestartForceExitStatus=52
   User=splunk
   Group=splunk
   Delegate=true
   CPUWeight=100
   MemoryMax=<total_available_system_memory>
   PermissionsStartOnly=true
   ExecStartPost=-/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/system.slice/%n"
   
   [Install]
   WantedBy=multi-user.target
   

   Note: In the cgroups v2 unit file, CPUWeight replaces CPUShares and MemoryMax replaces MemoryLimit.
   Note: The MemoryMax value is set to the total available system memory in bytes. The MemoryMax value does not update automatically if the total available system memory changes. To update the MemoryMax value, you must manually edit the unit file and run the systemctl daemon-reload command to reload systemd.
   CAUTION: The following unit file properties are set specifically for Splunk workload management:

   Type=simple

   Restart=always

   Delegate=true

   Do not change these values unless you are familiar with systemd or receive guidance from Splunk support.
   CAUTION: Do not use the following unit file properties. These properties can cause

   splunkd

   to fail on restart:

   RemainAfterExit=yes

   ExecStop

   For more information on systemd unit file configuration settings, see Service unit configuration.

7. Reload the unit file.

   sudo systemctl daemon-reload
   

8. Start splunkd.

   sudo $SPLUNK_HOME/bin/splunk start
   

   This starts splunkd as a systemd service.

   Note: Under systemd, splunk start|stop|restart commands are mapped to systemctl start|stop|restart commands.
9. Verify that splunkd is running as a systemd service:

   sudo systemctl status <SPLUNK_SERVER_NAME>.service
   

10. For distributed deployments, repeat steps 1-9 on all search heads and indexers.

When managing an indexer cluster under systemd:

You must use the sudo command to start, stop, and restart the cluster manager node or individual peer nodes using splunk start|stop|restart commands. You do not need sudo to perform a rolling restart using the splunk rolling-restart cluster-peers command, or to take a peer offline using the splunk offline command.

When managing a search head cluster under systemd:

You must use the sudo command to start, stop, and restart cluster members using splunk start|stop|restart commands. You do not need sudo to perform a rolling restart using the splunk rolling-restart shcluster-members command, or to remove a cluster member using the splunk remove shcluster-members command.

After you set up cgroups on your Linux operating system, you can configure workload management in Splunk Enterprise. See Configure workload management.