Enable boot-start on MacOS

Splunk software automatically creates a script and configuration file in the directory /System/Library/StartupItems on the volume that booted your Mac. This script runs when your Mac starts, and automatically stops Splunk when you shut down your Mac.

If you want, you can still enable boot-start manually. You must either have root level permissions or use sudo to run the following command. You must have at least administrator access to your Mac to use sudo. If you installed Splunk software in a different directory, replace the example below with your instance location.

  1. Log into your machine.
  2. Open the Terminal app.
  3. Change to the Splunk bin directory:
    CODE 
    cd /Applications/Splunk/bin
  4. Enable boot start:
    CODE 
    [sudo] ./splunk enable boot-start

Enable boot-start on MacOS as a non-root user

  1. Log into your machine.
  2. Open the Terminal app.
  3. Change to the Splunk bin directory:
    CODE 
    cd /Applications/Splunk/bin
  4. Enable boot start:
    CODE 
    [sudo] ./splunk enable boot-start -user <user Splunk Enterprise should run as>
  5. Open /Library/LaunchItems/com.splunk.plist for editing.
  6. Locate the line that begins with <dict>.
  7. Immediately after this line, add the following block of code:
    CODE 
    <key>UserName</key>
    <string><user Splunk Enterprise should run as></string>
  8. Save the file and close it.

Changes take effect the next time you boot the machine.