Deployment Architecture

Splunk Boot start is failing

kumar493
Path Finder

Hello ,

I configured splunk to start at boot time , i checked the permissions and the script all looks good to me , But when i am rebooting the server , Splunk is not starting up automatically.

here is my init.d script

#!/bin/sh
#
# /etc/init.d/splunk
# init script for Splunk.
# generated by 'splunk enable boot-start'.
#
# chkconfig: 2345 90 60
# description: Splunk indexer service
#
RETVAL=0
USER=splunk

. /etc/init.d/functions

splunk_start() {
echo Starting Splunk...
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" start --no-prompt --answer-yes'
RETVAL=$?
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_stop() {
echo Stopping Splunk...
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" stop'
RETVAL=$?
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/splunk
}
splunk_restart() {
echo Restarting Splunk...
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" restart'
RETVAL=$?
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/splunk
}
splunk_status() {
echo Splunk status:
su - ${USER} -c '"$SPLUNK_HOME/bin/splunk" status'
RETVAL=$?
}
case "$1" in
start)
splunk_start
;;
stop)
splunk_stop
;;
restart)
splunk_restart
;;
status)
splunk_status
;;
*)
echo "Usage: $0 {start|stop|restart|status}"
exit 1
;;
esac

exit $RETVAL

 

Once the VM is up after reboot , When i check manually the status of splunk it says its not running and getting below messages 

splunkd 6519 was not running.
Stopping splunk helpers...
[ OK ]
Done.
Stopped helpers.
Removing stale pid file... done.
splunkd is not running.

Labels (2)
1 Solution

kumar493
Path Finder

I identified the issue , Their was a mistake in init script , After correcting it , The boot start worked.

View solution in original post

0 Karma

nwuest
Path Finder

Hi kumar493,

A few questions to see where you are at and what you have done:

  1. What version of Splunk are you running?
  2. Have you looked at the splunkd.log located in the following to check for errors of why its not starting?
    /opt/splunk/var/log/splunk/splunkd.log (if you are using Splunk Enterprise) OR
    /opt/splunkforwarder/var/log/splunk/splunkd.log (if you are using Splunk Universal Forwarder)
  3. To enable Splunk to start after boot/reboot, did you use the following command:
    # /opt/splunk/bin/splunk enable boot-start                               (Splunk Enterprise Instance)
    # /opt/splunkforwarder/bin/splunk enable boot-start          (Splunk Universal Forwarder Instance)

 

Look forward to hearing back from you!

V/R,

nwuest

kumar493
Path Finder
  1. What version of Splunk are you running? : 7.3.3 splunk version
  2. /opt/splunk/var/log/splunk/splunkd.log  :  Not seeing anything specific pattern
  3. /opt/splunk/bin/splunk enable boot-start      : yes i ran it even if the init.d script looks same as other server we have but after rebooting the server splunk is not starting automatically.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
What will happen when you are running this script as root?
Have you tried use systemd version of boot start?
r. Ismo
0 Karma

kumar493
Path Finder

What will happen when you are running this script as root? : I never tried to run it as root , All i tried is rebooting the server and hoping splunk will start automatically but its not starting.

Have you tried use systemd version of boot start?

- No i haven't tried of using that.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please try those as then you will get the exact error or succes messages and see what really has happened.
0 Karma

kumar493
Path Finder

I identified the issue , Their was a mistake in init script , After correcting it , The boot start worked.

View solution in original post

0 Karma

yamini_37
Path Finder

Hi @kumar493 

I am facing the similar issue with splunk boot start implementation. Could you please let me know what changes you made in init script.

 

Thanks in advance

0 Karma

harsha
Loves-to-Learn Lots

Please post the resolution. It can help some one.

 

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!