Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

[charvey007]

Hi there,

I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra following the documentation for installing and running splunk as a non-root user here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Installation/RunSplunkasadifferentornon-rootuser

So far everything is working fine with the exception of getting boot-start to work. I've followed the documentation on setting that up here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

However, whenever I reboot the machine after making the edits to com.splunk.plist splunk doesn't start until I start manually. This is the contents of the com.splunk.plist before I restart the machine.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UserName</key>
    <string>splunk</string>
    <key>Label</key>
    <string>com.splunk</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/splunkforwarder/bin/splunk</string>
        <string>start</string>
        <string>--no-prompt</string>
        <string>--answer-yes</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Any ideas on how to proceed? Any help would be appreciated.

[salbro · Accepted solution]

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

[sudeshgaur]

Hi, I am also seeing same issue. is this issue resolved for you?

[deepashri_123]

Hey charvey007,

You can refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

Let me know if this helps!!