Getting Data In

Why is Splunkd not starting after a reboot, wih Systemd enable-boot start?

yannK
Splunk Employee
Splunk Employee

We setup splunkd to autostart using systemd.
-> https://docs.splunk.com/Documentation/Splunk/latest/Admin/RunSplunkassystemdservice

but when the linux server reboot, we did no see Splunkd starting, we had to manually start it.

Labels (1)
Tags (3)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

TL;DR : you need systemd setup AND splunkd service enabled for it to kick in.

____

 

1) Check if you have the systemd script setup :
/etc/systemd/system/Splunkd.service

2) check if the Splunkd service is enabled

 

systemctl status Splunkd

 



when it's enabled and started, you will see

● Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 46min ago
 Main PID: 982 (splunkd)
   Memory: 1.0G (limit: 1.7G)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore




If it's disabled and not started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)



if it's disabled but was manually started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 51min ago
 Main PID: 982 (splunkd)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore


if you do not see it enabled, enable it

 

systemctl enable Splunkd

 



Then it should autostart when you reboot your server.

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

TL;DR : you need systemd setup AND splunkd service enabled for it to kick in.

____

 

1) Check if you have the systemd script setup :
/etc/systemd/system/Splunkd.service

2) check if the Splunkd service is enabled

 

systemctl status Splunkd

 



when it's enabled and started, you will see

● Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 46min ago
 Main PID: 982 (splunkd)
   Memory: 1.0G (limit: 1.7G)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore




If it's disabled and not started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)



if it's disabled but was manually started you will see

 Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
   Loaded: loaded (/etc/systemd/system/Splunkd.service; disabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-04-13 14:46:44 UTC; 4h 51min ago
 Main PID: 982 (splunkd)
   CGroup: /system.slice/Splunkd.service
           ├─ 982 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd
           ├─1756 [splunkd pid=982] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner]
           ├─2279 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --storageEngine=mmapv1 --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize...
           ├─2408 /opt/splunk/bin/python3.7 -O /opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
           └─2411 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089 --with-kvstore


if you do not see it enabled, enable it

 

systemctl enable Splunkd

 



Then it should autostart when you reboot your server.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...