Splunk Enterprise

Starting splunk as non root user

stevenm1
New Member

Hi,
Looks like this question has been asked numerous times but I'm not seeing same issue as what I have. On Suse Linux 11.4 I have installed the forwarder but I cannot get it to start under splunk user using the startup scripts under inittab. I ran the "splunk enable boot-start -user splunk" command as root. It seems to just create an init.d file with no splunk user references so when the server reboots it again starts as root.
What is supposed to change in this file ? I tried adding the -user splunk param to below line but just hangs.

splunk_start() {
echo Starting Splunk...
"/opt/splunkforwarder/bin/splunk" start --no-prompt --answer-yes
RETVAL=$?
}

What am I doing wrong?

Tags (1)
0 Karma

ddrillic
Ultra Champion

Just please keep in mind that the purpose of splunk enable boot-start -user splunkis to create the automatic server boot start commands for Splunk.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Are you talking about Suse Linux Enterprise Server? I would change the following line

 "/opt/splunkforwarder/bin/splunk" start --no-prompt --answer-yes

into this:

sudo -u splunk -c '/opt/splunkforwarder/bin/splunk start'

IIRC, that's how I used to create my startup scripts in /etc/init.d with SLES11 and SLES12.

Skalli

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...