How to resolve "splunk.service could not be found"?

[henryf]

Trying to install splunk on ubuntu instance within e3, I've partitioned and formatted the drive and every step works fine but whenever I get to the last step I keep running into this issue. How can I solve it?

[henryf]

Thanks!

[danspav]

HI @henryf ,

I assume you've run the boot-start command to generate the service file:

./splunk enable boot-start -user splunk -systemd-managed 1

You can check what the service name is by looking here:

ls -l /etc/systemd/system

On my host it's called splunkd.service so I start splunk by running:

systemctl start splunkd

Make sure you match the case and name with the service file.

Give that a go and see if it starts. There's more info in docs:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/RunSplunkassystemdservice

Cheers,
Daniel

[isoutamo · Accepted solution]

Hi

I add some clarifications on @danspav 's answer.

1st you must start splunk with Splunk User (I expecting that you are using this user for splunk) like

/opt/splunk/bin/splunk start --accept-license --answer-yes

Add splunk's internal admin user + password to it.

Then stop splunk and after that you must switch back to root user to enable boot start.

You could check which name is used for that service by

[root@splunk-demo-rh8] ~>
(0) # systemctl |egrep -i splunk|egrep service
Splunkd.service                                                                     loaded active running   Systemd service file for Splunk, generated by 'splunk enable boot-start'
[root@splunk-demo-rh8] ~>
(0) #

 I expecting that your name is something like splunk. If it't totally different then just ls on @danspav example and find which service file contains command splunk start.

r. Ismo