Getting Data In

Starting splunk forwarder at boot

amanteja
Path Finder

Here is the situation

  1. We have a splunk forwarder installed (from rpm), but never started in an Amazon AMI
  2. What we want is that when a new machine is spun up using that image the following things should happen
    1. Splunk forwarder should always start at boot up
    2. If the splunk deamon dies it should be restarted
    3. It should pick up the IP of the host correctly
    4. The license screen should be bypassed.
    5. The input and output conf files appropriate to send to the splunk host shoudl be put in place

What are the suggestions to do that?
How can we check whether the data is being sent successfully to the hosts?

Tags (2)

rturk
Builder

Hi Amanteja,

1 - To enable automatic start on boot:

$SPLUNK_HOME/bin/splunk enable boot-start

2 - Restarting a failed process is a OS specific (non-Splunk) configuration option. A quick Google search came up with this for RedHat, but may not be totally suitable for your environment:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/2.1/html/Cluster_Manager...

3 - This is an OS setting. Splunk will pick up whatever IP address is assigned by the host.

4 - The license page is only displayed upon the first start of the Universal Forwarder. If started with the following prompts, this will not be seen again:

$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license

5 - To pick up the desired configuration, I would have the host pick up the configuration from a central Deployment Server. Details of how to do this can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver

Happy Splunking 🙂

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...