Hello Splunkers,
I have installed splunk universal forwarder (ARMv6) on Raspbeery pi (running on Raspbeery OS 32 bit). I had enabled splunkd instance for user splunk (not an admin user) by following commands
1. sudo chown -R splunk: /opt/splunkforwarder
2. sudo /opt/splunkforwarder/bin/splunk enable boot-start -systemd-managed 1 -user splunk -group splunk
3. sudo su splunk
4. sudo systemctl start SplunkForwarder
unfortunately I get the following error:
Job for SplunkForwarder.service failed because the control process exited with error code.
See "systemctl status SplunkForwarder.service" and "journalctl -xe" for details
SplunkForwarder.service:
#This unit file replaces the traditional start-up script for systemd
#configurations, and is used when enabling boot-start for Splunk on
#systemd-based Linux distributions.
[Unit]
Description=Systemd service file for Splunk, generated by 'splunk enable boot-start'
After=network.target
[Service]
Type=simple
Restart=always
ExecStart=/opt/splunkforwarder/bin/splunk _internal_launch_under_systemd
KillMode=mixed
KillSignal=SIGINT
TimeoutStopSec=360
LimitNOFILE=65536
SuccessExitStatus=51 52
RestartPreventExitStatus=51
RestartForceExitStatus=52
User=splunk
Group=splunk
Delegate=true
CPUShares=1024
MemoryLimit=1963114496
PermissionsStartOnly=true
ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"
[Install]
WantedBy=multi-user.target
root@raspberrypi:/etc/systemd/system#
Does anyone have an idea how to enable systemd service on Raspberry pi so that splunk start automatically even with reboot?
