Monitoring Splunk

How do I validate that boot-start was indeed enabled?

ddrillic
Ultra Champion

As the Splunk farm grows we end up with servers for which the boot-start was not enabled and for heaven’s sake, splunk started as root. How do I validate that the boot-start was enabled? Hopefully across the cluster…

Tags (2)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest /services/server/settings
| fields + startwebserver  splunk_server

I'm not 100% sure if startwebserver is boot-start

View solution in original post

0 Karma

bmunson_splunk
Splunk Employee
Splunk Employee

This command will check both init-d and systemd on unix. Without the sudo should work on windows.

sudo ./splunk display boot-start
0 Karma

phil_wong
Explorer

Sorry... startwebserver means only Web (aka :8000) I guess. Does it really imply boot-start?

ddrillic
Ultra Champion

On our Linux machines the /etc/rc.d/init.d/splunk script exists on the servers which have the boot-start enabled.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| rest /services/server/settings
| fields + startwebserver  splunk_server

I'm not 100% sure if startwebserver is boot-start

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...