Fresh install of Splunk 6.3.2 wrong value of SPLUNK_OS_USER in splunk-launch.conf

[misterlas]

Hello all,

Installed splunk-6.3.2-aaff59bb082c-linux-2.6-x86_64.rpm today on RHEL 7.2 and could not get it to start. Received the following error:

[root@splunk bin]# ./splunk start
The value of env var SPLUNK_OS_USER, "splunkuser", does not match any user on this system;
 Error : Success.: Success
Please run 'splunk ftr' as boot-start user

/opt/splunk/etc/splunk-launch.conf has default value of

SPLUNK_OS_USER=splunkuser

...changed value to (since there is a 'splunk' user and NOT 'splunkuser' user)

SPLUNK_OS_USER=splunk

and was able to start successfully. Just thought I'd bring this to your attention.

[talk2gupta]

Hi,

I am using splunkforwarder 7.0 facing below error while ran
./splunk enable boot-start -user splunk
The value of env var SPLUNK_OS_USER, "splunk", does not match any user on this system;
Error : Success.: Success

This command can only be run by bootstart user.
First-time-run has not finished. Ignore this error when previewing migration - exiting.

ll /root/splunkforwarder-7.0.0-c8a78efdd40f-Linux-x86_64.tgz
-rw-r--r-- 1 root root 21708334 Sep 26 23:46 /root/splunkforwarder-7.0.0-c8a78efdd40f-Linux-x86_64.tgz

Regards,
Sonu Kumar Gupta

[renjith_nair]

By default for all the installation, the variable will be commented out in splunk-launch.conf

# If SPLUNK_OS_USER is set, then Splunk service will only start
# if the 'splunk [re]start [splunkd]' command is invoked by a user who
# is, or can effectively become via setuid(2), $SPLUNK_OS_USER.
# (This setting can be specified as username or as UID.)
#
# SPLUNK_OS_USER

In your case you might have entered it while configuring it.

[misterlas]

Negative to performing configuration. I installed the rpm and attempted to start the application and received the error in my original post. Tasks were performed on a fresh VM.

[renjith_nair]

Still not able to understand how you came across that. I had tried tgz and now tried rpm and still working

Installed from rpm and by default SPLUNK_OS_USER is commented out

 rpm -ivh --prefix=/tmp/ splunk-6.3.2-aaff59bb082c-linux-2.6-x86_64.rpm
Preparing...                ########################################### [100%]
   1:splunk                 ########################################### [100%]
complete


 cat /tmp/splunk/etc/splunk-launch.conf
#   Version 6.3.2

# Modify the following line to suit the location of your Splunk install.
# If unset, Splunk will use the parent of the directory this configuration
# file was found in
#
SPLUNK_HOME=/tmp/splunk

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory.  This can be overridden
# here:
#
# SPLUNK_DB=/home/build/build-home/ember/var/lib/splunk

# Splunkd daemon name
SPLUNK_SERVER_NAME=Splunkd

# Splunkweb daemon name
SPLUNK_WEB_NAME=splunkweb

# If SPLUNK_OS_USER is set, then Splunk service will only start
# if the 'splunk [re]start [splunkd]' command is invoked by a user who
# is, or can effectively become via setuid(2), $SPLUNK_OS_USER.
# (This setting can be specified as username or as UID.)
#
# SPLUNK_OS_USER