Starting splunk forwarder at boot

[amanteja]

Here is the situation

1. We have a splunk forwarder installed (from rpm), but never started in an Amazon AMI
2. What we want is that when a new machine is spun up using that image the following things should happen
   1. Splunk forwarder should always start at boot up
   2. If the splunk deamon dies it should be restarted
   3. It should pick up the IP of the host correctly
   4. The license screen should be bypassed.
   5. The input and output conf files appropriate to send to the splunk host shoudl be put in place

What are the suggestions to do that?
How can we check whether the data is being sent successfully to the hosts?

[rturk]

Hi Amanteja,

1 - To enable automatic start on boot:

$SPLUNK_HOME/bin/splunk enable boot-start

2 - Restarting a failed process is a OS specific (non-Splunk) configuration option. A quick Google search came up with this for RedHat, but may not be totally suitable for your environment:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/2.1/html/Cluster_Manager...

3 - This is an OS setting. Splunk will pick up whatever IP address is assigned by the host.

4 - The license page is only displayed upon the first start of the Universal Forwarder. If started with the following prompts, this will not be seen again:

$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license

5 - To pick up the desired configuration, I would have the host pick up the configuration from a central Deployment Server. Details of how to do this can be found here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Aboutdeploymentserver

Happy Splunking 🙂