Unable to boot start splunk during installation of splunk forwarder 6.2.2

[nirmalya2006]

Hi All

I quite new to splunk and I am trying to install splunk universal forwarder 6.2.2 on linux systems.
Below are the commands that I have in a shell script which is executed by root user.

1. tar -zxvf splunkuniversalforwarder-6.2.2-255606-Linux-x86_64.gz -C /opt
2. groupadd splunk
3. useradd -g splunk splunk
4. chown -R splunk:splunk /opt/splunkforwarder
5. export SPLUNK_HOME=/opt/splunkforwarder
6. export PATH=$SPLUNK_HOME/bin:$PATH
7. splunk enable boot-start -user splunk --accept-license --answer-yes
8. service splunk start

The script is executing perfectly till step 6.
On step 7 the script gets hung and there is no output and neither the script proceeds ahead.

I am unable to understand if this is an issue with the linux server where I am trying to install the forwarder or something is wrong with the installer.
Can someone please help me on this.

Thanks
Nirmalya

[nirmalya2006 · Accepted solution]

Well for some reason ./splunk start --accept-license or splunk enable boot-start -user splunk was not working on this particular Linux server. We are yet to figure out the reason.
So we had to use service splunk enable boot-start -user splunk and service splunk start to get the thing working.

For other cases we were getting error message
For ./splunk start --accept-license we got Unrecognized service
For splunk enable boot-start -user splunk the command execution went to hung state

Good thing is the service is now working fine with service splunk start/stop/restart commands

[aaraneta_splunk]

@nirmalya2006 - Did your answer provide a working solution to your question? If yes and you would like to close out your post, don't forget to click "Accept" and upvote any previous answers/comments that were helpful. But if you'd like to keep it open for possibilities of other answers, then you don't have to take action on it yet.

[gcusello]

Hi nirmalya2006,
instead of item 7 and 8 you should run the following commands

• cd /opt/splunkuniversalforwarder/bin
• ./splunk start --accept-license
• splunk enable boot-start -user splunk

In addition I suggest to use rpm command because in this way you avoid items 2,3,4,5 and 6
you have only three items:

• rpm -i splunkuniversalforwarder-6.2.2-255606-Linux-x86_64.rpm
• cd /opt/splunkuniversalforwarder/bin
• ./splunk start --accept-license
• splunk enable boot-start -user splunk

Every way see http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Installanixuniversalforwarder

Bye.
Giuseppe

[woodcock]

You have an extra ./splunk start --accept-license.

[gcusello]

yes sorry! cut and past error!
Bye.
Giuseppe

[nirmalya2006]

I also tried to manually execute the same command but it remains hung and I had to terminate the execution
splunk enable boot-start -user splunk --accept-license --answer-yes