Getting Data In

Why is Splunkd not starting after a reboot, wih Systemd enable-boot start?

yannK
Splunk Employee
Splunk Employee

We setup splunkd to autostart using systemd.
-> https://docs.splunk.com/Documentation/Splunk/latest/Admin/RunSplunkassystemdservice

but when the linux server reboot, we did no see Splunkd starting, we had to manually start it.

Labels (1)
Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

TL;DR : you need systemd setup AND splunkd service enabled for it to kick in.

____

 

1) Check if you have the systemd script setup :
/etc/systemd/system/Splunkd.service

2) check if the Splunkd service is enabled

 

systemctl status Splunkd

 



when it's enabled and started, you will see

● Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 46min ago
 Main PID: 982 (splunkd)
   Memory: 1.0G (limit: 1.7G)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore




If it's disabled and not started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)



if it's disabled but was manually started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 51min ago
 Main PID: 982 (splunkd)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore


if you do not see it enabled, enable it

 

systemctl enable Splunkd

 



Then it should autostart when you reboot your server.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

TL;DR : you need systemd setup AND splunkd service enabled for it to kick in.

____

 

1) Check if you have the systemd script setup :
/etc/systemd/system/Splunkd.service

2) check if the Splunkd service is enabled

 

systemctl status Splunkd

 



when it's enabled and started, you will see

● Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 46min ago
 Main PID: 982 (splunkd)
   Memory: 1.0G (limit: 1.7G)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore




If it's disabled and not started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)



if it's disabled but was manually started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 51min ago
 Main PID: 982 (splunkd)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore


if you do not see it enabled, enable it

 

systemctl enable Splunkd

 



Then it should autostart when you reboot your server.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...