Configure Splunk to Start at System Startup

Starting with version 3.1.1, Splunk provides a utility that will update your system boot configuration so that Splunk starts when the system boots up. This utility will create a suitable init script (or make a similar configuration change, depending on your OS).

As root, run
splunk enable boot-start

If you don't start Splunk as root, you can pass in the -user parameter to specify which user to start Splunk as. For example, if Splunk runs as the user bob, then as root you would run
splunk enable boot-start -user bob

If you want to stop Splunk from running at system startup time, run
splunk disable boot-start

More information is available in $SPLUNK_HOME/etc/init.d/README and if you type help boot-start from the command line.

If you are using a version that is older than 3.1.1, refer to the README in $SPLUNK_HOME/etc/init.d for instructions on how to modify your startup configuration so that Splunk starts up at boot time.
If Splunk is running as non-root, you must modify the startup script to use sudo. See Running as a non root user for more information.
Note: This is only true for versions older than 3.1.1. The boot-start command does this automatically with the -user flag.

Previous: Automated installation | Next: Run Splunk as a non-root user

Comments

Regarding the StartupItem installed under Mac OS X 10.4 [Server], the correct location for it to be installed to is /Library/StartupItems/, not /System/Library/StartupItems/.
Posted by morgant on Feb 20 2008, 5:42am
Correction, additional privileges are needed for splunkd to start as the splunk user on Solaris 10.

# usermod -K defaultpriv=basic,net_privaddr,proc_exec,proc_fork splunk
Posted by cudgel on Nov 14 2007, 10:29am
To allow the splunk user to bind to reserved ports on Solaris 10, run the following command (as root):

# usermod -K defaultpriv=basic,net_privaddr splunk
Posted by cudgel on Nov 14 2007, 5:37am