Getting Data In

Why am I unable to boot-start splunk universal forwarder as non-root user on MacOS High Sierra?

charvey007
Engager

Hi there,

I'm new to Splunk and am testing out installing splunk forwarder on some Mac clients running High Sierra following the documentation for installing and running splunk as a non-root user here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Installation/RunSplunkasadifferentornon-rootuser

So far everything is working fine with the exception of getting boot-start to work. I've followed the documentation on setting that up here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

However, whenever I reboot the machine after making the edits to com.splunk.plist splunk doesn't start until I start manually. This is the contents of the com.splunk.plist before I restart the machine.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UserName</key>
    <string>splunk</string>
    <key>Label</key>
    <string>com.splunk</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/splunkforwarder/bin/splunk</string>
        <string>start</string>
        <string>--no-prompt</string>
        <string>--answer-yes</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Any ideas on how to proceed? Any help would be appreciated.

1 Solution

salbro
Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

View solution in original post

0 Karma

salbro
Path Finder

@sudeshgaur,

My support case on this issue was resolved -- we found that the file was being put into /Library/LaunchAgents, and instead it needs to be in /Library/LaunchDaemons. Our boot-start worked at that point, and I believe Splunk updated the documentation regarding this.

Also be sure you have the following:
-Permissions on the plist (0644)
-Verify owner on the Application (chown -R yoursplunkuser /Applications/SplunkForwarder.app)

0 Karma

sudeshgaur
New Member

Hi, I am also seeing same issue. is this issue resolved for you?

0 Karma

deepashri_123
Motivator

Hey charvey007,

You can refer this link below:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/ConfigureSplunktostartatboottime#Enable_boot...

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...