Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- Re: bootstart user
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
After rebooting the server when I checked splunk services were not running. So I tried to start the splunk services, but getting the below error
this command can only be run by bootstart user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming linux, and you have sudo access and your server should run as splunk.
sudo su splunk -
/opt/splunk/bin splunk start
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
/etc/init.d/splunk start used to work running as the root user and we're trying to troubleshoot why it suddenly stopped working?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd recommend you check splunk-launch.conf for the user, su to the user: su <user> and then run /opt/splunk/bin/splunk start and see what error messages it shows (if any) and please note I assumed Splunk is installed under /opt/splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Issue was fixed 2 days back after restarting the splunk from /opt/splunk/bin
But we always start, stop the splunk services in /etc/init.d location, after rebooting the server and when we tried to start the service in /etc/init.d it was throwing error like "the command can only be run by bootstart user". Then I started the service in /opt/splunk/bin and it got restarted. Now, I am just curious to know why it was not working under /etc/init.d ???
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is your server using systemd?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming linux, and you have sudo access and your server should run as splunk.
sudo su splunk -
/opt/splunk/bin splunk start
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check inside splunk-launch.conf for SPLUNK_OS_USER then su to this user and start the Splunk service
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...
The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise
Data Management Digest – September 2026
