Startup options

This topic discusses options for starting Splunk and Splunk server processes after a new installation.

Note: By convention, this document uses:

$SPLUNK_HOME to identify the path to your Splunk installation.
$SPLUNK_HOME/bin/ to indicate the location of the command line interface.

Add Splunk to your shell path

Before you continue, you may want to set a SPLUNK_HOME environment variable and add $SPLUNK_HOME/bin to your shell's path. The example below works for bash users who accepted the default installation location. Use the correct syntax and path for your own installation.

# export SPLUNK_HOME=/opt/splunk
# export PATH=$SPLUNK_HOME/bin:$PATH

Start Splunk

To start Splunk, use the command line interface:

$SPLUNK_HOME/bin/splunk start

Splunk displays the license agreement and prompts you to accept the before the startup sequence continues.

To automatically accept the license when you start Splunk for the first time, add the accept-license option to the start command:

$SPLUNK_HOME/bin/splunk start --accept-license

The startup sequence displays:

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Verifying configuration.  This may take a while...
Finished verifying configuration.
Checking index directory...
Verifying databases...
Verified databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sampledata, splunklogger, summary

Checking index files
All index checks passed.
All preliminary checks passed.
Starting splunkd...
Starting splunkweb...
Splunk Server started. 

The Splunk web interface is at http://<hostname>:8000 
If you get stuck, we're here to help.  Feel free to email us at 'support@splunk.com'.

There are two other start options: no-prompt and answer-yes:

If you run $SPLUNK_HOME/bin/splunk start --no-prompt, Splunk proceeds with startup until it requires you to answer a question. Then, it displays the question, why it is quitting, and quits.
If you run SPLUNK_HOME/bin/splunk start --answer-yes, Splunk proceeds with startup and automatically answers "yes" to all yes/no questions. Splunk displays the question and answer as it continues.

If you run start with all three options in one line, for example:

$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license

Splunk does not ask you to accept the license.
Splunk answers yes to any yes/no question.
Splunk quits when it encounters a non-yes/no question.

Start individual processes

You can start and stop individual Splunk processes by adding the process as an object to the start command. The objects include:

splunkd, the Splunk server daemon.
splunkweb, Splunk's Web interface process.
watchdog, a keep-alive process that restarts splunkd if it shuts down. This option does not work on Windows. Instead, set recovery options in the Service Management console.

For example, to start only splunkd:

$SPLUNK_HOME/bin/splunk start splunkd

Or to start Splunk watchdog:

$SPLUNK_HOME/bin/splunk start watchdog

Note: To shutdown watchdog, use the following command:

$SPLUNK_HOME/bin/splunk stop watchdog

Start help

For more information about start, refer to the CLI help page:

$SPLUNK_HOME/bin/splunk help start

Open Splunk in a Web browser

After Splunk starts, it displays the URL for Splunk Web at the end of its startup summary:

The Splunk web interface is at http://<hostname>:<port>

Note that <hostname> is specific to the machine on which you've installed Splunk and <port> is the HTTP port you defined at installation. The HTTP port defaults to 8000 if not otherwise specified.

To access Splunk Web, open a Web browser to this URL. Refer to the System Requirements for the list of supported Web browsers for your operating system.

To begin using Splunk, refer to the User Manual and Splunk Tutorial.

Previous: Windows installation via the commandline | Next: License management

Comments

@deanpence:

watchdog is a keep-alive process that monitors splunkd and resurrects it if it goes down.

you can start splunk with the following command to run it in the foreground:

./splunk start splunkd --nodaemon
Posted by emma on Dec 12 2008, 2:09pm
Does the watchdog do anything special besides watching for when the splunkd process exits/crashes?

If so I'd like to find out how I can run splunkd in the foreground to use with my own supervisor (a la runit or daemontools). Are there arguments I can pass to "splunk start splunkd"?
Posted by deanpence on Dec 12 2008, 2:18am
@Mykol_j: SSL should be off by default. If it was on automatically, I recommend you contact Splunk support.

As far as the other comments -- thanks for the feedback. We will look into rearranging this section so it is more intuitive.
Posted by emma on Dec 04 2008, 1:52pm
applemike: i forgot the url, see http://www.splunk.com/download
Posted by jrodman on Dec 04 2008, 11:45am
applemike: We currently provide 32bit versions for OS X, windows, linux, solaris x86, and freebsd.

For the most part, 32bit is useful for forwarders, 64bit has significant advantages for an indexer when it's possible to deploy on such arches.
Posted by jrodman on Dec 04 2008, 11:45am
32-bit version??
Posted by applemike on Dec 04 2008, 11:34am
Ok, very nice. There is a section entitled "Advanced Installation Topics" that discusses user creation...

Perhaps something called "Configure Splunk before startup" should come earlier than the actual portions that have you starting Splunk... just a thought, call me crazy.
Posted by Mykol_j on Dec 04 2008, 8:53am
Did I miss the default user and/or the user account creation...? I'm installed, running, and staring at the web login page... Now I *really* feel stupid...
Posted by Mykol_j on Dec 04 2008, 8:47am
Documentation is wrong when referring to URL -- I did a total default install following the docs to a "T" -- and the URL is (SSL) https://{system name}:8000
Posted by Mykol_j on Dec 04 2008, 8:46am
pjharper: added instructions for setting a SPLUNK_HOME environmental variable. if you still get the error when trying to start Splunk, you may want to email support@splunk.com. thanks!
Posted by sophy on Sep 19 2008, 11:03am