Deployment Architecture

Centos 7 - Splunk 7.4.2 - Enable/Disable boot start - issues as non-root user


We have setup "enable boot-start" as the non-root user "splunk" and it's not systemd managed:
/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes

From what I have read, this changes the SPLUNK_OS_USER in splunk-launch.conf, as well as creates a new init.d script. However, according to this document, you still need to edit the init.d script to run splunkd as a non-root user. I would have thought that specifying "-user splunk" would have been enough to ensure this happened.

So can you please verify that, in order to properly run splunk as non-root user and for splunk to start at boot, you need to:

  1. Enable boot-start as per the command above;
  2. Edit the init.d script to ensure that the commands are being run as the appropriate non-root user.

I ask this because this makes maintenance a bit more tricky. Say I want to disable boot-start. This deletes the init.d script apparently. Then when we run the enable boot-start command again, the file is re-created, without our edits. So we need to edit the file again. Failing to do so could cause issues when splunk is started on boot as root rather than the non-root user.


All the times that I have to enable it at boot, I used the root id to run the command "/opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes". This command already add the line to init.d when you run it under root. Maybe if you want to disable it, it would be better you sudo root and only comment the line for boot start.

Check this answer ->

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...