topic Re: Can't get started... in Splunk Enterprise

Can't get started...

snickered — Fri, 07 Nov 2014 20:04:01 GMT

I've followed the installation instructions for FreeBSD but am not able to start splunk as a non-root user upon boottime.

root@fbsd3:~ # $SPLUNK_HOME/bin/splunk enable boot-start -user splunk
Shared object "libxml2.so.11" not found, required by "splunkd"
Shared object "libxml2.so.11" not found, required by "splunkd"
Shared object "libxml2.so.11" not found, required by "splunkd"
Did not find "disabled" setting of "kvstore" stanza in server bundle.
Can't create RC file "/etc/rc.d/splunk": Permission denied
root@fbsd3:~ # su - splunk
splunk@fbsd3:~ % $SPLUNK_HOME/bin/splunk enable boot-start -user splunk
Can't create RC file "/etc/rc.d/splunk": Permission denied

But I'm able to run splunk fine as the user splunk:

splunk@fbsd3:~ % /opt/splunk/bin/splunk start

Splunk Like an F-18, bro.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Done

Waiting for web server at http://127.0.0.1:8000 to be available. Done

If you get stuck, we're here to help.

Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://fbsd3.domain.local:8000

Re: Can't get started...

frmaasdam — Fri, 07 Nov 2014 20:58:58 GMT

Check the ownerships of ALL your Splunk files.

Re: Can't get started...

snickered — Sat, 08 Nov 2014 15:33:01 GMT

Alright, so it looks like there was something wrong with my rc script. Here's a patch for FreeBSD-current users. I got the answer from here: http://lists.freebsd.org/pipermail/freebsd-current/2012-January/031246.html. Sorry for the (non)formatting, I can't ever get the pre tags to work on this forum.

root@fbsd3:~ # diff -u /etc/rc.d/splunk.orig /etc/rc.d/splunk
--- /etc/rc.d/splunk.orig       2014-11-07 17:21:12.000000000 -0600
+++ /etc/rc.d/splunk    2014-11-08 09:24:36.000000000 -0600
@@ -12,7 +12,7 @@

 name=splunk
 extra_commands="status"
-rcvar=`set_rcvar`
+rcvar=splunk_enable
 eval "${rcvar}=\${${rcvar}:-'NO'}"

 splunk_start()
root@fbsd3:~ #

After a reboot all is good and splunkd is running as my splunk user. 🙂

Re: Can't get started...

snickered — Sat, 08 Nov 2014 15:33:02 GMT

I'm pretty sure it was a permissions problem. Originally I tried this guide: http://wiki.splunk.com/Deploy:EnsuringSplunkRunsAsNonRootUser and it didn't workout too well. I started over and used the guide here: http://docs.splunk.com/Documentation/Splunk/latest/installation/RunSplunkasadifferentornon-rootuser#Instructions. That worked out well and everything seems to be fine with the exception of "boot-start" (http://docs.splunk.com/Documentation/Splunk/latest/admin/ConfigureSplunktostartatboottime#Enable_boot-start_on_.2Anix_platforms) not working. I'm going to start a new thread for that if I can't figure it out pretty soon.