Starting Splunk Enterprise using "systemctl start splunk " with --accept-license=yes

[vksplunk1]

Hi - Recently we have upgraded splunk to version 9.1.3 . Noticed that I can not not start the splunk using :

"./splunk start --accept-licnese = yes" , forcing my to use "systemctl start Splunkd" to start splunk

Could you please let me know how to pass --accept-license=yes with "systemctl start Splunkd"

[marnall]

Note that you only have to accept the license once (per newly installed version), not every time you run Splunkd using systemctl.

You can thus run the "./splunk start --accept-license=yes"  command once, then afterwards use "systemctl start Splunkd"

[vksplunk1]

Thank you for the suggestion.  But I have mentioned, The current Splunk has been setup such that it's not letting me to use ./splunk start to accept license.

The only way I can start the splunk using systemctl start Splunkd

[marnall]

I am curious how you set up the systemd service with Splunk without running ./splunk as the splunk user. What happens when you try to become the splunk user and run the splunk binary?

If it absolutely does not work, it might be possible to pass the commands in by modifying the Splunkd.service file: (usually at /etc/systemd/system/Splunkd.service)

It will have a line of:

ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd

which could have the arguments added:

ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd --accept-license --answer-yes

As I don't know how to set my test machine to unaccept the license, I am not able to test this at the moment.