restarting Splunk forwarder on Linux

splunktrainingu — Tue, 22 Dec 2020 01:00:02 GMT

Hello the issue I am having is with the following command:

./splunk restart

When I try to restart I get the following message:

As Su user: Failed to run splunk as SPLUNK_OS_USER. This command can only be run by bootstart user. without su user: please run 'splunk ftr' as boot-start user

I am not understanding what it is asking me to do...

I want to mention that puppet is the tool we use to deploy the UF to our linux servers. I am trying to restart the UF because I want to see if the linux server will use the splunk server as a deploymentserver by adding a deploymentclient.conf file to SplunkUniversalForwarder/etc/system/local.

Re: restarting Splunk forwarder on Linux

scelikok — Tue, 22 Dec 2020 05:08:16 GMT

@splunktrainingu,

Please check splunk-launch.conf for SPLUNK_OS_USER then su to this user and start the Splunk service like below; (assuming SPLUNK_OS_USER is splunk)

sudo su splunk - /opt/splunk/bin splunk start

If this reply helps you upvote is appreciated.

topic Re: restarting Splunk forwarder on Linux in Splunk Enterprise

restarting Splunk forwarder on Linux

Re: restarting Splunk forwarder on Linux