I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra following the documentation for installing and running splunk as a non-root user here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Installation/RunSplunkasadifferentornon-rootuser
So far everything is working fine with the exception of getting boot-start to work. I've followed the documentation on setting that up here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...
However, whenever I reboot the machine after making the edits to
com.splunk.plist splunk doesn't start until I start manually. This is the contents of the
com.splunk.plist before I restart the machine.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>UserName</key> <string>splunk</string> <key>Label</key> <string>com.splunk</string> <key>ProgramArguments</key> <array> <string>/Applications/splunkforwarder/bin/splunk</string> <string>start</string> <string>--no-prompt</string> <string>--answer-yes</string> </array> <key>RunAtLoad</key> <true/> </dict> </plist>
Any ideas on how to proceed? Any help would be appreciated.
Hi, I am also seeing same issue. is this issue resolved for you?
My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.
Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)