topic Re: Mac OS Yosemite - How to start at boot time? in All Apps and Add-ons

Mac OS Yosemite - How to start at boot time?

letsee — Thu, 30 Oct 2014 14:29:43 GMT

Before upgrading to Yosemite the boot-enable feature was working but now getting an error that says "hostconfig file not found". I checked the file and it has been removed for Yosemite. Any way to get the boot start to work?

Re: Mac OS Yosemite - How to start at boot time?

nickhills — Thu, 27 Nov 2014 09:13:58 GMT

This is a problem for me too on the UF.

Re: Mac OS Yosemite - How to start at boot time?

mdonnelly_splun — Tue, 10 Feb 2015 23:02:52 GMT

In Splunk 6.2.1 (and older), the "enable boot-start" on the Mac relies on the StartupItems feature of OSX. The StartupItems feature was deprecated awhile back, OS X Yosemite removed support completely. With Yosemite, Apple relies on "launchd/launchctl" for process startup.

SERIOUS AND MAJOR KUDOS to the folks who created http://launchd.info for a great site on how launchd works!

The good news is that you can fix this with the workaround below. This is provided as a workaround, and not officially supported. Test on non-critical systems, etc. If you don't feel comfortable in a terminal window - you should probably not proceed.

Use the attached file and save it to: /Library/LaunchDaemons/com.splunk.bootstart.plist

Edit the file, note the file path, and change it as necessary. (Unless you're running Splunk in /opt/splunkforwarder like I do!)

The sample file is functional but doesn't show off any fancy launchd options, Splunk will run as user "root" unless you modify the .plist file by adding UserName key/value pairs. StdOut / StdErr are set to help troubleshoot, but may be removed if you don't want them.

Once the file is edited and saved, issue the following commands to set permissions and load the profile:

sudo chown root /Library/LaunchDaemons/com.splunk.bootstart.plist
sudo chmod644 /Library/LaunchDaemons/com.splunk.bootstart.plist
sudo launchctl load -w /Library/LaunchDaemons/com.splunk.bootstart.plist

If everything worked, splunk will start immediately when you run the command above. And at every reboot thereafter.

Happy Splunking!

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
    <dict>
       <key>Label</key>
       <string>com.splunk.bootstart</string>
       <key>ProgramArguments</key>
       <array>
          <string>/opt/splunkforwarder/bin/splunk</string>
          <string>start</string>
       </array>
       <key>RunAtLoad</key>
       <true />
       <key>StandardErrorPath</key>
       <string>/tmp/splunkboot.stderr</string>
       <key>StandardOutPath</key>
       <string>/tmp/splunkboot.stdout</string>
    </dict>
 </plist>

Re: Mac OS Yosemite - How to start at boot time?

firehaus — Wed, 21 Oct 2015 19:07:22 GMT

Thanks. This fix appears to be working.

Re: Mac OS Yosemite - How to start at boot time?

anthonysomerset — Mon, 25 Apr 2016 17:56:27 GMT

typo in your chmod command (missing a space) but works perfectly even with the DMG installed version if you modify the path to the splunk binary correctly - and confirmed working on el Capitan (10.11.x)

Re: Mac OS Yosemite - How to start at boot time?

beezwax — Wed, 18 Oct 2017 20:53:02 GMT

First of all, how come this isn't installed by default now?

Also, could someone fix that typo already mentioned on the second chmod command (add a space)?

Finally, the above does not work with version 7 since the path to splunk has changed, so here is an updated version:

<?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
     <dict>
        <key>Label</key>
        <string>com.splunk.bootstart</string>
        <key>ProgramArguments</key>
        <array>
           <string>/opt/splunkforwarder/bin/splunk</string>
           <string>start</string>
        </array>
        <key>RunAtLoad</key>
        <true />
        <key>StandardErrorPath</key>
        <string>/tmp/splunkboot.stderr</string>
        <key>StandardOutPath</key>
        <string>/tmp/splunkboot.stdout</string>
     </dict>
  </plist>