Monitoring Splunk

How do I validate that boot-start was indeed enabled?

ddrillic
Ultra Champion

As the Splunk farm grows we end up with servers for which the boot-start was not enabled and for heaven’s sake, splunk started as root. How do I validate that the boot-start was enabled? Hopefully across the cluster…

Tags (2)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest /services/server/settings
| fields + startwebserver  splunk_server

I'm not 100% sure if startwebserver is boot-start

View solution in original post

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

This command will check both init-d and systemd on unix. Without the sudo should work on windows.

sudo ./splunk display boot-start
0 Karma

phil_wong
Explorer

Sorry... startwebserver means only Web (aka :8000) I guess. Does it really imply boot-start?

ddrillic
Ultra Champion

On our Linux machines the /etc/rc.d/init.d/splunk script exists on the servers which have the boot-start enabled.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest /services/server/settings
| fields + startwebserver  splunk_server

I'm not 100% sure if startwebserver is boot-start

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...