unable to enable boot-start in RHEL 9

[Somesh]

I have downloaded splunk 9.2 rpm file and installed on rhel9.2. While i'm running splunk enable boot-start it's throwing  the error as below. 

[root@splunk~]# splunk enable boot-start
execve: No such file or directory
  while running command /sbin/chkconfig
[root@splunk~]#

Can someone help me on this ?

[Somesh]

Thanks for the update @gcusello. It worked by running the command "splunk enable boot-start -systemd-managed 1". Also what is the best practice to start the splunk ? Is that needs to be started by "root" user or the "splunk" user 

[gcusello · Accepted solution]

Hi @Somesh ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[Somesh]

What's the best way to start the splunk ? Is it with root user or with the splunk user ? 

[gcusello]

Hi @Somesh ,

this seems to be a different question and I hint to open a new question to be more sure to have more and probably better answers.

Anyway, Splunk best practices hint to run Splunk as not root user, for security reasons, but this gives some additional difficoultes in log reading, 

For more additional information see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Installation/RunSplunkasadifferentornon-rootuser

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @Somesh,

please try some of these (starting from the first url):

https://www.aidanwardman.com/enabling-boot-start-in-splunk-on-rhel-9-rocky-9/

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/ConfigureSplunktostartatboottime

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/RunSplunkassystemdservice

Ciao.

Giuseppe