Installation

Systemd services on Raspberry pi

bhvk619
New Member

Hello Splunkers,

I have installed splunk universal forwarder (ARMv6) on Raspbeery pi (running on Raspbeery OS 32 bit). I had enabled splunkd instance for user splunk (not an admin user) by following commands

1. sudo chown -R splunk: /opt/splunkforwarder
2.  sudo /opt/splunkforwarder/bin/splunk enable boot-start -systemd-managed 1 -user splunk -group splunk
3.  sudo su splunk
4. sudo systemctl start SplunkForwarder  

unfortunately I get the following error:

Job for SplunkForwarder.service failed because the control process exited with error code.
See "systemctl status SplunkForwarder.service" and "journalctl -xe" for details

SplunkForwarder.service:

 

 

#This unit file replaces the traditional start-up script for systemd
#configurations, and is used when enabling boot-start for Splunk on
#systemd-based Linux distributions.

[Unit]
Description=Systemd service file for Splunk, generated by 'splunk enable boot-start'
After=network.target

[Service]
Type=simple
Restart=always
ExecStart=/opt/splunkforwarder/bin/splunk _internal_launch_under_systemd
KillMode=mixed
KillSignal=SIGINT
TimeoutStopSec=360
LimitNOFILE=65536
SuccessExitStatus=51 52
RestartPreventExitStatus=51
RestartForceExitStatus=52
User=splunk
Group=splunk
Delegate=true
CPUShares=1024
MemoryLimit=1963114496
PermissionsStartOnly=true
ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"

[Install]
WantedBy=multi-user.target
root@raspberrypi:/etc/systemd/system#

 


Does anyone have an idea how to enable systemd service on Raspberry pi so that splunk start automatically even with reboot? 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Fisrtly, don't do "su splunk" if you want ot "sudo systemctl" (unless you have very strange sudoers restrictions).

Secondly:

See "systemctl status SplunkForwarder.service" and "journalctl -xe" for details

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...