Installation

unable to enable boot-start in splunk forwarder on Centos

Gopinath
Loves-to-Learn

We can install Splunk forwarder through ansible tower while executing enable at boot-start we are facing the same error.

OS- CentOS Linux release 7.8.2003 (Core)

 UF - Linux version 7.2.3

command using : /app/splunk/splunkforwarder/bin/./splunk enable boot-start -user awsadmin

Error:

---------------------------------------------------------------------------

execve: No such file or directory

while running command /sbin/chkconfig

---------------------------------------------------------------------

I tried as root user as well, but still facing the error. I tried all answers from splunk community but nothing worked for me.

 

Please help, why is this issue coming at all? How to resolve it?

 

 

 

 

Labels (4)
0 Karma

harsha
Loves-to-Learn Lots

Hello Gopinath,

 

Did you got this resolved?. I am also having this issue for RHEL6 only.,  please help

0 Karma

thambisetty
SplunkTrust
SplunkTrust

First try running below modified command line:

/app/splunk/splunkforwarder/bin/splunk enable boot-start -user awsadmin
Whats version of forwarder? 
is service managed by systemctl or init.d service?

————————————
If this helps, give a like below.
Tags (1)
0 Karma

Gopinath
Loves-to-Learn

The service is managed by init.d script

The version of UF is 7.2.3

After running this command only I am getting this issue.

/app/splunk/splunkforwarder/bin/splunk enable boot-start -user awsadmin

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...