Nice work - pbalsley
I would add a few corrections. When you touch the plist file above I had to add the ".plist" file extension to match the other Daemons being launched in this directory so the commands would be as follows:
cd /Library/LaunchDaemons/
sudo touch com.splunk.splunkforwarder.plist
sudo chown root:wheel com.splunk.splunkforwarder.plist
sudo chmod 644 com.splunk.splunkforwarder.plist
sudo nano com.splunk.splunkforwarder.plist
Also add the xml plist tags to the file as such:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<false/>
<key>Disabled</key>
<false/>
<key>RunAtLoad</key>
<true/>
<key>LaunchOnlyOnce</key>
<true/>
<key>Label</key>
<string>com.splunk.splunkforwarder</string>
<key>ProgramArguments</key>
<array>
<string>/Applications/SplunkForwarder/bin/splunk</string>
<string>start</string>
<string>--no-prompt</string>
<string>--answer-yes</string>
</array>
</dict>
</plist>
... View more