As the Splunk farm grows we end up with servers for which the boot-start was not enabled and for heaven’s sake, splunk started as root. How do I validate that the boot-start was enabled? Hopefully across the cluster…
Try this
| rest /services/server/settings
| fields + startwebserver splunk_server
I'm not 100% sure if startwebserver
is boot-start
This command will check both init-d and systemd on unix. Without the sudo should work on windows.
sudo ./splunk display boot-start
Sorry... startwebserver means only Web (aka :8000) I guess. Does it really imply boot-start?
On our Linux machines the /etc/rc.d/init.d/splunk
script exists on the servers which have the boot-start enabled.
Try this
| rest /services/server/settings
| fields + startwebserver splunk_server
I'm not 100% sure if startwebserver
is boot-start