Enable boot-start on *nix platforms

Splunk provides a utility that updates your system boot configuration so that the software starts when the system boots up. This utility creates an init script (or makes a similar configuration change, depending on your OS).

  1. Log into the machine that you have installed Splunk software on and that you want to configure to run at boot time.
  2. Become the root user if able. Otherwise, you must run the following commands with the sudo utility.
  3. Run the following command:
    CODE 
    [sudo] $SPLUNK_HOME/bin/splunk enable boot-start

Note: The init.d boot-start script is not compatible with RHEL 8 and higher. You can instead configure systemd to manage boot start and run splunkd as a service. For more information, see Enable boot start on machines that run systemd.

Enable boot-start as a non-root user

If you do not run Splunk software as the root user, you can pass in the -user parameter to specify the Splunk software user. The user that you want to run Splunk software as must already exist. If it does not, then create the user prior to running this procedure.

The following procedure configures Splunk software to start at boot time as the user 'bob'. You can substitute 'bob' with the user that Splunk software should use to start at boot time on the local machine.

  1. Log into the machine.
  2. Become the root user.
  3. Run the following command:
    CODE 
    [sudo] $SPLUNK_HOME/bin/splunk enable boot-start -user bob
  4. Change the ownership of the Splunk installation directory and all its files to user bob:
    CODE 
    [sudo] chown -R bob $SPLUNK_HOME
  5. Using a text editor, open /etc/init.d/splunk for editing.
  6. Update the service file to add the service user, and enclose the command in single quotes. Note the addition of the user field and {USER} variables su - ${USER} -c, and the placement of single quotes to encapsulate only the service command. The init.d service file will have minor differences based upon the *nix distribution and version. An example is provided in the "After" table.
    Before
    JSON 
    RETVAL=0

. /etc/init.d/functions

splunk_start() {
  echo Starting Splunk...
  "$SPLUNK_HOME/bin/splunk" start --no-prompt --answer-yes
  RETVAL=$?
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_stop() {
  echo Stopping Splunk...
 "$SPLUNK_HOME/bin/splunk" stop
  RETVAL=$?
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk
}
splunk_restart() {
  echo Restarting Splunk...
  "$SPLUNK_HOME/bin/splunk" restart
  RETVAL=$?
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_status() {
  echo Splunk status:
  "$SPLUNK_HOME/bin/splunk" status
  RETVAL=$?
}
case "$1" in
    After
    JSON 
    RETVAL=0
USER=bob

. /etc/init.d/functions

splunk_start() {
  echo Starting Splunk...
  su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" start --no-prompt --answer-yes'
  RETVAL=$?
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_stop() {
  echo Stopping Splunk...
  su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" stop'
  RETVAL=$?
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk
}
splunk_restart() {
  echo Restarting Splunk...
  su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" restart'
  RETVAL=$?
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_status() {
  echo Splunk status:
  su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" status'
  RETVAL=$?
}
case "$1" in

    Note: Confirm that each splunk command has single quotes around it, and is preceded with the service user substitution.
  7. Save the file and close it.

Changes take effect the next time you boot the machine.

Enable boot-start on machines that run systemd

On Linux machines that use the systemd system manager, you can configure Splunk Enterprise to let systemd control it. By default, Splunk Enterprise configures itself to run as a init-managed service, and does not use systemd.

  1. Log into the machine that you have installed Splunk software on and that you want to configure to run at boot time.
  2. Become the root user if able. Otherwise, you must run the following commands with the sudo utility.
  3. Run the following command:
    CODE 
    [sudo] $SPLUNK_HOME/bin/splunk enable boot-start -user bob -systemd-managed 1

See Run Splunk Enterprise as a systemd serviceNo Content found for /db/organizations/splunk/repositories/splunk-10_4/content/documents/Platform/Splunk/Splunk_Admin/RunSplunkassystemdservice/RunSplunkassystemdservice.dita#id_24012f09_734e_4ab4_99d1_808e091fc95e/Run_Splunk_Enterprise_as_a_systemd_service for additional information on Splunk Enterprise and systemd.

Enable boot-start on machines that run AIX

Note: These instructions work for both Splunk Enterprise and the AIX version of the Splunk universal forwarder. Splunk does not offer a version of Splunk Enterprise for AIX for versions later than 6.3.0.

The AIX version of Splunk does not register itself to auto-start on machine boot. You can configure it to use the System Resource Controller (SRC) to handle boot-time startup.

When you enable boot start on an AIX system, Splunk software interacts with the AIX SRC to enable automatic starting and stopping of Splunk services.

mkssys -G splunk -s splunkd -p <path to splunkd> -u <splunk user> -a _internal_exec_splunkd -S -n 2 -f 9

mkssys -G splunk -s splunkweb -p <path to python> -u <splunk user> -a _internal_exec_splunkweb -S -n 15 -f 9 (on Splunk Enterprise only)

When you enable automatic boot start, the SRC handles the run state of the Splunk Enterprise service. You must use a different command to start and stop Splunk software manually.

  • /usr/bin/startsrc -s splunkd to start Splunk software manually.
  • /usr/bin/stopsrc -s splunkd to stop Splunk software manually.

If you try to start and stop the software with the ./splunk [start|stop] method from the $SPLUNK_HOME directory, the SRC catches the attempt and displays the following message:

Splunk boot-start is enabled. Please use /usr/bin/[startsrc|stopsrc] -s splunkd to [start|stop] Splunk.

To prevent this message from occurring and restore the ability to start and stop Splunk Enterprise from the $SPLUNK_HOME directory, disable boot start:

[sudo] ./splunk disable boot-start
  • For more information on the mkssys command line arguments, see Mkssys command on the IBM pSeries and AIX Information Center website.
  • For more information on the SRC, see System resource controller on the IBM Knowledge Center website.

Enable boot-start on AIX to run Splunk Software as a root user

  1. Log into the AIX machine.
  2. Become the root user, if able. Otherwise, you must prepend sudo to the following command examples. If you do not have sudo on your AIX instance, you must download, install, and configure it.
  3. Change to the Splunk bin directory.
  4. Enable boot start:
    [sudo] ./splunk enable boot-start

Enable boot-start on AIX to run Splunk software as a non-root user

  1. Log into the AIX machine.
  2. Become the root user, if able. Otherwise, you must prepend sudo to the following command examples. If you do not have sudo on your AIX instance, you must download, install, and configure it.
  3. Create the user account that the Splunk software should run as. For example, if the splunk user should run the software:
    CODE 
    [sudo] mkuser splunk
[sudo] chown -R splunk <Splunk directory>
  4. Change to the Splunk bin directory.
  5. Enable boot start and specify the -user flag with the user that the software should run as. [sudo] ./splunk enable boot-start -user <user that Splunk should run as>