Greetings, I am setting up a new 8.2.2 environment, Red Hat 8.1 and trying to get Splunk to start on boot and to run under a different user than root. I can start it up manually under the "splunk" user without any problems but on boot, it does not. What I have done so far: $SPLUNK_HOME/bin/splunk enable boot-start -user splunk in /etc/init.d/splunk #!/bin/sh RETVAL=0 . /etc/init.d/functions splunk_start() { echo Starting Splunk... su - splunk -c '"/opt/splunk/bin/splunk" start --no-prompt --answer-yes' RETVAL=$? [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk } splunk_stop() { echo Stopping Splunk... su - splunk -c '"/opt/splunk/bin/splunk" stop' RETVAL=$? [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk } splunk_restart() { echo Restarting Splunk... su - splunk -c '"/opt/splunk/bin/splunk" restart' RETVAL=$? [ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk } splunk_status() { echo Splunk status: su - splunk -c '"/opt/splunk/bin/splunk" status' RETVAL=$? } case "$1" in start) splunk_start ;; stop) splunk_stop ;; restart) splunk_restart ;; status) splunk_status ;; esac exit $RETVAL   in /opt/splunk/etc/splunk-launcher.conf # Version 8.2.2 # Modify the following line to suit the location of your Splunk install. # If unset, Splunk will use the parent of the directory containing the splunk # CLI executable. # SPLUNK_HOME=/opt/splunk # By default, Splunk stores its indexes under SPLUNK_HOME in the # var/lib/splunk subdirectory. This can be overridden # here: # # SPLUNK_DB=/opt/splunk-home/var/lib/splunk # Splunkd daemon name SPLUNK_SERVER_NAME=Splunkd # If SPLUNK_OS_USER is set, then Splunk service will only start # if the 'splunk [re]start [splunkd]' command is invoked by a user who # is, or can effectively become via setuid(2), $SPLUNK_OS_USER. # (This setting can be specified as username or as UID.) # # SPLUNK_OS_USER SPLUNK_OS_USER=splunk in sudoers splunk ALL=(ALL) NOPASSWD: /opt/splunk/bin/splunk restart splunk ALL=(ALL) NOPASSWD: /opt/splunk/bin/splunk stop splunk ALL=(ALL) NOPASSWD: /opt/splunk/bin/splunk start splunk ALL=(ALL) NOPASSWD: /opt/splunk/bin/splunk status   Could it be an issue with SELinux? Thanks in Advance John ... View more

Greetings, I've installed the Cisco eStreamer eNcore for Splunk Add-On and the setup option is missing to input the FMC Hostname, Port and PKCS12 info . I have removed and installed several times. Has anyone else come across this issue? Thanks in Advance, ~John ... View more

Hi, we have an API that we are starting to send data to HEC. When I place      [httpServer] crossOriginSharingHeaders = "http://<FQDN>:<PORT>"     in the server.conf under /etc/system/local, I get an error upon restarting Splunk.    Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 39, in <module> from splunk.rcUtils import makeRestCall, CliArgError, NoEndpointError, InvalidStatusCodeError File "/opt/splunk/lib/python3.7/site-packages/splunk/rcUtils.py", line 17, in <module> from splunk.search import dispatch, getJob, listJobs File "/opt/splunk/lib/python3.7/site-packages/splunk/search/__init__.py", line 2238, in <module> TEST_NAMESPACE = splunk.getDefault('namespace') File "/opt/splunk/lib/python3.7/site-packages/splunk/__init__.py", line 79, in getDefault setDefault() File "/opt/splunk/lib/python3.7/site-packages/splunk/__init__.py", line 66, in setDefault getLocalServerInfo() File "/opt/splunk/lib/python3.7/site-packages/splunk/__init__.py", line 36, in getLocalServerInfo mergeHostPath(hostpath, True) File "/opt/splunk/lib/python3.7/site-packages/splunk/__init__.py", line 136, in mergeHostPath setDefault('port', int(port)) ValueError: invalid literal for int() with base 10: '4200""\nhttps://127.0.0.1:8089' What would cause Splunk from starting? Thanks in advince, ~John ... View more