Monitoring Splunk

How do I validate that boot-start was indeed enabled?

ddrillic
Ultra Champion

As the Splunk farm grows we end up with servers for which the boot-start was not enabled and for heaven’s sake, splunk started as root. How do I validate that the boot-start was enabled? Hopefully across the cluster…

Tags (2)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest /services/server/settings
| fields + startwebserver  splunk_server

I'm not 100% sure if startwebserver is boot-start

View solution in original post

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

This command will check both init-d and systemd on unix. Without the sudo should work on windows.

sudo ./splunk display boot-start
0 Karma

phil_wong
Explorer

Sorry... startwebserver means only Web (aka :8000) I guess. Does it really imply boot-start?

ddrillic
Ultra Champion

On our Linux machines the /etc/rc.d/init.d/splunk script exists on the servers which have the boot-start enabled.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest /services/server/settings
| fields + startwebserver  splunk_server

I'm not 100% sure if startwebserver is boot-start

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...