Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

Glad it worked out! Good job! ... View more

i have poweruser roles not the admin roles and if i try doing search with index=test "index=test action=search" nuthing shows up it looks like no action field available for every index ?? ... View more

lol, I see just now that your problem is not my problem. I should go into the weekend 😄 My problem is, that I use the searchmanager to execute a search which writes data from the dashboard (basically the dashboards sole reason is collecting user input which can't be automatically collected) into a summary index. There it occurs sometimes that one search results in two events added to the index. In other words the search is executed twice, but not the js code. Any idea anyway? ... View more