Starting splunk forwarder at boot

amanteja — Sat, 07 Sep 2013 15:11:40 GMT

Here is the situation

We have a splunk forwarder installed (from rpm), but never started in an Amazon AMI
What we want is that when a new machine is spun up using that image the following things should happen
1. Splunk forwarder should always start at boot up
2. If the splunk deamon dies it should be restarted
3. It should pick up the IP of the host correctly
4. The license screen should be bypassed.
5. The input and output conf files appropriate to send to the splunk host shoudl be put in place

What are the suggestions to do that?
How can we check whether the data is being sent successfully to the hosts?

Re: Starting splunk forwarder at boot

rturk — Sun, 08 Sep 2013 01:48:25 GMT

Hi Amanteja,

1 - To enable automatic start on boot:

$SPLUNK_HOME/bin/splunk enable boot-start

2 - Restarting a failed process is a OS specific (non-Splunk) configuration option. A quick Google search came up with this for RedHat, but may not be totally suitable for your environment:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/2.1/html/Cluster_Manager_Installation_and_Administration/s1-service-errorstate.html

3 - This is an OS setting. Splunk will pick up whatever IP address is assigned by the host.

4 - The license page is only displayed upon the first start of the Universal Forwarder. If started with the following prompts, this will not be seen again:

$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license

5 - To pick up the desired configuration, I would have the host pick up the configuration from a central Deployment Server. Details of how to do this can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver

Happy Splunking 🙂

topic Re: Starting splunk forwarder at boot in Getting Data In

Starting splunk forwarder at boot

Re: Starting splunk forwarder at boot