What are the possible return values from the Splunk init script?

[JHill]

I have a Splunk forwarder instance that appears to be returning a value of 2 during start up.

I am curious as to what the possible return values are for the init script and what they mean.

[jrodman · Accepted solution]

I assume you mean the script which ends up as /etc/init.d/splunk or similar?
This thing invokes the launcher (bin/splunk) and passes its return values along.

The values don't appear to be that useful right now.

• 0 obviously is success.
• 4 seems to suggest permissions problems
• 8 refers to environment problems

The new 4.1 command line work incorporates this table:

#define EXIT_NO_ARGS 8
#define EXIT_CMD_IGNORE 9
#define EXIT_FAILURE_USAGE 10
#define EXIT_FAILURE_DEPRECATED_CMD 11
#define EXIT_FAILURE_PARSE_CMD_LINE 12
#define EXIT_FAILURE_NO_HELP_EXISTS 14
#define EXIT_FAILURE_NO_DISPLAY_FUNC 15
#define EXIT_FAILURE_NO_CMD_EXISTS 16
#define EXIT_FAILURE_NOT_IMPLEMENTED 18
#define EXIT_FAILURE_NO_OBJ_EXISTS 19
#define EXIT_FAILURE_FGETS_READ 20
#define EXIT_FAILURE_REQD_ARG_MISSING 21
#define EXIT_FAILURE_REST_CALL 22
#define EXIT_FAILURE_DISPLAY_FUNC_ERR 23
#define EXIT_FAILURE_LOGIN 24
#define EXIT_FAILURE_URI_FORMAT 25

However we incorporate third party libraries. For example in some circumstances openssl (how the splunk executable communicates with splunkd) will exit(2) on its own. Compiling a complete list right now is not likely to be useful.

Instead I would suggest:

1. Try launching splunk yourself, ideally with the same user that the script does, or run the script yourself (sh -x -v /etc/init.d/splunk start) to see what happens.
2. Review $SPLUNK_HOME/var/log/splunk/splunkd_stderr.log and splunkd.log