I am trying to autostart Splunk on my VMware data collection node. I am in $SPLUNK_HOME/bin/
splunk enable boot-start
returns Can't create RC file "/etc/init.d/splunk": Permission denied
sudo splunk enable boot-start
returns sudo: splunk: command not found
I am logged in as splunkadmin
Could someone explain what's going on here?
you'll need to specify the full path to the splunk binary:
sudo /app/splunk/bin/splunk enable boot-start
For example. Replace with your path as required.
Also, do NOT forget to update the $SPLUNK_HOME/etc/splunk-launch.conf file with the appropriate username:
SPLUNK_OS_USER=splunkadmin
HCadmins,
I'd recommend using full file paths when trying to enable boot start, such as:
sudo /opt/splunk/bin/splunk enable boot-start
Where "/opt/splunk" is "$SPLUNK_HOME", so adjust accordingly. The problem is once you run sudo you no longer have "$SPLUNK_HOME" in your environment variables.
Alternatively if you're in the correct directory you can tell sudo that the binary is in the current directory by doing:
sudo ./splunk enable boot-start