Deployment Architecture
Highlighted

Restarting Splunk Agent when Home Directory is changed

SplunkTrust
SplunkTrust

I have some servers that don't comply to our newer Splunk Standards, and I'm doing a "Remediation" on the servers that need home directories changed, increased disk space, etc.

Will Splunkd need to be restarted after changing its home directory?

Thanks

Tags (3)
0 Karma
Highlighted

Re: Restarting Splunk Agent when Home Directory is changed

Motivator

If you are relocating the base install directory of Splunk on Unix, aka SPLUNK_HOME, then yes you would need to stop Splunk, relocate the directory, then start Splunk. On Unix, be sure, to update any boot script paths under /etc/init.d if you have enabled Splunk start on OS reboot.

If you are relocating on Windows, you would likely need to uninstall, then reinstall, first backing up the etc folder for configs you need to save.

View solution in original post

0 Karma
Highlighted

Re: Restarting Splunk Agent when Home Directory is changed

SplunkTrust
SplunkTrust

Thank you, Rob!

I also want to make sure the startup sequence is added. Is that simply $SPLUNK_HOME/bin/splunk enable boot-start?

0 Karma
Highlighted

Re: Restarting Splunk Agent when Home Directory is changed

Motivator

Correct, that will work if running the forwarder as the root account. You'll need sudo or root permissions to run the command.

$SPLUNK_HOME/bin/splunk enable boot-start

If running as a non-root account i.e. splunk, then you'll need to use the -user switch to start it as that user.

$SPLUNK_HOME/bin/splunk enable boot-start -user splunk

0 Karma