Getting Data In

Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

Engager

Hi there,

I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra following the documentation for installing and running splunk as a non-root user here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Installation/RunSplunkasadifferentornon-rootuser

So far everything is working fine with the exception of getting boot-start to work. I've followed the documentation on setting that up here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

However, whenever I reboot the machine after making the edits to com.splunk.plist splunk doesn't start until I start manually. This is the contents of the com.splunk.plist before I restart the machine.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UserName</key>
    <string>splunk</string>
    <key>Label</key>
    <string>com.splunk</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/splunkforwarder/bin/splunk</string>
        <string>start</string>
        <string>--no-prompt</string>
        <string>--answer-yes</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Any ideas on how to proceed? Any help would be appreciated.

1 Solution

Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

View solution in original post

0 Karma

Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

View solution in original post

0 Karma

New Member

Hi, I am also seeing same issue. is this issue resolved for you?

0 Karma

Motivator

Hey charvey007,

You can refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

Let me know if this helps!!

0 Karma