Installation

Fresh install of Splunk 6.3.2 wrong value of SPLUNK_OS_USER in splunk-launch.conf

misterlas
Engager

Hello all,

Installed splunk-6.3.2-aaff59bb082c-linux-2.6-x86_64.rpm today on RHEL 7.2 and could not get it to start. Received the following error:

[root@splunk bin]# ./splunk start
The value of env var SPLUNK_OS_USER, "splunkuser", does not match any user on this system;
 Error : Success.: Success
Please run 'splunk ftr' as boot-start user

/opt/splunk/etc/splunk-launch.conf has default value of

SPLUNK_OS_USER=splunkuser

...changed value to (since there is a 'splunk' user and NOT 'splunkuser' user)

SPLUNK_OS_USER=splunk

and was able to start successfully. Just thought I'd bring this to your attention.

talk2gupta
New Member

Hi,

I am using splunkforwarder 7.0 facing below error while ran
./splunk enable boot-start -user splunk
The value of env var SPLUNK_OS_USER, "splunk", does not match any user on this system;
Error : Success.: Success

This command can only be run by bootstart user.
First-time-run has not finished. Ignore this error when previewing migration - exiting.

ll /root/splunkforwarder-7.0.0-c8a78efdd40f-Linux-x86_64.tgz
-rw-r--r-- 1 root root 21708334 Sep 26 23:46 /root/splunkforwarder-7.0.0-c8a78efdd40f-Linux-x86_64.tgz

Regards,
Sonu Kumar Gupta

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

By default for all the installation, the variable will be commented out in splunk-launch.conf

# If SPLUNK_OS_USER is set, then Splunk service will only start
# if the 'splunk [re]start [splunkd]' command is invoked by a user who
# is, or can effectively become via setuid(2), $SPLUNK_OS_USER.
# (This setting can be specified as username or as UID.)
#
# SPLUNK_OS_USER

In your case you might have entered it while configuring it.

Happy Splunking!
0 Karma

misterlas
Engager

Negative to performing configuration. I installed the rpm and attempted to start the application and received the error in my original post. Tasks were performed on a fresh VM.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Still not able to understand how you came across that. I had tried tgz and now tried rpm and still working

Installed from rpm and by default SPLUNK_OS_USER is commented out

 rpm -ivh --prefix=/tmp/ splunk-6.3.2-aaff59bb082c-linux-2.6-x86_64.rpm
Preparing...                ########################################### [100%]
   1:splunk                 ########################################### [100%]
complete


 cat /tmp/splunk/etc/splunk-launch.conf
#   Version 6.3.2

# Modify the following line to suit the location of your Splunk install.
# If unset, Splunk will use the parent of the directory this configuration
# file was found in
#
SPLUNK_HOME=/tmp/splunk

# By default, Splunk stores its indexes under SPLUNK_HOME in the
# var/lib/splunk subdirectory.  This can be overridden
# here:
#
# SPLUNK_DB=/home/build/build-home/ember/var/lib/splunk

# Splunkd daemon name
SPLUNK_SERVER_NAME=Splunkd

# Splunkweb daemon name
SPLUNK_WEB_NAME=splunkweb

# If SPLUNK_OS_USER is set, then Splunk service will only start
# if the 'splunk [re]start [splunkd]' command is invoked by a user who
# is, or can effectively become via setuid(2), $SPLUNK_OS_USER.
# (This setting can be specified as username or as UID.)
#
# SPLUNK_OS_USER
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...