Getting Data In
Highlighted

Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

Engager

Hi there,

I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra following the documentation for installing and running splunk as a non-root user here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Installation/RunSplunkasadifferentornon-rootuser

So far everything is working fine with the exception of getting boot-start to work. I've followed the documentation on setting that up here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

However, whenever I reboot the machine after making the edits to com.splunk.plist splunk doesn't start until I start manually. This is the contents of the com.splunk.plist before I restart the machine.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UserName</key>
    <string>splunk</string>
    <key>Label</key>
    <string>com.splunk</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/splunkforwarder/bin/splunk</string>
        <string>start</string>
        <string>--no-prompt</string>
        <string>--answer-yes</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Any ideas on how to proceed? Any help would be appreciated.

Highlighted

Re: Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

Motivator

Hey charvey007,

You can refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

Let me know if this helps!!

0 Karma
Highlighted

Re: Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

New Member

Hi, I am also seeing same issue. is this issue resolved for you?

0 Karma
Highlighted

Re: Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

View solution in original post

0 Karma