Deployment Architecture

Splunk Boot start is failing

kumar493
Path Finder

Hello ,

I configured splunk to start at boot time , i checked the permissions and the script all looks good to me , But when i am rebooting the server , Splunk is not starting up automatically.

here is my init.d script

#!/bin/sh
#
# /etc/init.d/splunk
# init script for Splunk.
# generated by 'splunk enable boot-start'.
#
# chkconfig: 2345 90 60
# description: Splunk indexer service
#
RETVAL=0
USER=splunk

. /etc/init.d/functions

splunk_start() {
echo Starting Splunk...
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" start --no-prompt --answer-yes'
RETVAL=$?
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_stop() {
echo Stopping Splunk...
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" stop'
RETVAL=$?
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk
}
splunk_restart() {
echo Restarting Splunk...
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" restart'
RETVAL=$?
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_status() {
echo Splunk status:
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" status'
RETVAL=$?
}
case "$1" in
start)
splunk_start
;;
stop)
splunk_stop
;;
restart)
splunk_restart
;;
status)
splunk_status
;;
*)
echo "Usage: $0 {start|stop|restart|status}"
exit 1
;;
esac

exit $RETVAL

 

Once the VM is up after reboot , When i check manually the status of splunk it says its not running and getting below messages 

splunkd 6519 was not running.
Stopping splunk helpers...
[ OK ]
Done.
Stopped helpers.
Removing stale pid file... done.
splunkd is not running.

Labels (2)
1 Solution

kumar493
Path Finder

I identified the issue , Their was a mistake in init script , After correcting it , The boot start worked.

View solution in original post

0 Karma

nwuest
Path Finder

Hi kumar493,

A few questions to see where you are at and what you have done:

  1. What version of Splunk are you running?
  2. Have you looked at the splunkd.log located in the following to check for errors of why its not starting?
    /opt/splunk/var/log/splunk/splunkd.log (if you are using Splunk Enterprise) OR
    /opt/splunkforwarder/var/log/splunk/splunkd.log (if you are using Splunk Universal Forwarder)
  3. To enable Splunk to start after boot/reboot, did you use the following command:
    # /opt/splunk/bin/splunk enable boot-start                               (Splunk Enterprise Instance)
    # /opt/splunkforwarder/bin/splunk enable boot-start          (Splunk Universal Forwarder Instance)

 

Look forward to hearing back from you!

V/R,

nwuest

kumar493
Path Finder
  1. What version of Splunk are you running? : 7.3.3 splunk version
  2. /opt/splunk/var/log/splunk/splunkd.log  :  Not seeing anything specific pattern
  3. /opt/splunk/bin/splunk enable boot-start      : yes i ran it even if the init.d script looks same as other server we have but after rebooting the server splunk is not starting automatically.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
What will happen when you are running this script as root?
Have you tried use systemd version of boot start?
r. Ismo
0 Karma

kumar493
Path Finder

What will happen when you are running this script as root? : I never tried to run it as root , All i tried is rebooting the server and hoping splunk will start automatically but its not starting.

Have you tried use systemd version of boot start?

- No i haven't tried of using that.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please try those as then you will get the exact error or succes messages and see what really has happened.
0 Karma

kumar493
Path Finder

I identified the issue , Their was a mistake in init script , After correcting it , The boot start worked.

0 Karma

yamini_37
Path Finder

Hi @kumar493 

I am facing the similar issue with splunk boot start implementation. Could you please let me know what changes you made in init script.

 

Thanks in advance

0 Karma

harsha
Loves-to-Learn Lots

Please post the resolution. It can help some one.

 

 

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...