Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

charvey007
Engager

Hi there,

I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra following the documentation for installing and running splunk as a non-root user here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Installation/RunSplunkasadifferentornon-rootuser

So far everything is working fine with the exception of getting boot-start to work. I've followed the documentation on setting that up here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

However, whenever I reboot the machine after making the edits to com.splunk.plist splunk doesn't start until I start manually. This is the contents of the com.splunk.plist before I restart the machine.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UserName</key>
    <string>splunk</string>
    <key>Label</key>
    <string>com.splunk</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/splunkforwarder/bin/splunk</string>
        <string>start</string>
        <string>--no-prompt</string>
        <string>--answer-yes</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Any ideas on how to proceed? Any help would be appreciated.

1 Solution

salbro
Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

View solution in original post

0 Karma

salbro
Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

View solution in original post

0 Karma

sudeshgaur
New Member

Hi, I am also seeing same issue. is this issue resolved for you?

0 Karma

deepashri_123
Motivator

Hey charvey007,

You can refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

Let me know if this helps!!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!