bootstart user

[VijaySrrie]

Hi,

After rebooting the server when I checked splunk services were not running. So I tried to start the splunk services, but getting the below error

this command can only be run by bootstart user

[VijaySrrie]

/etc/init.d/splunk start used to work running as the root user and we're trying to troubleshoot why it suddenly stopped working?

[gfreitas]

I'd recommend you check splunk-launch.conf for the user, su to the user: su <user> and then run /opt/splunk/bin/splunk start and see what error messages it shows (if any) and please note I assumed Splunk is installed under /opt/splunk

[VijaySrrie]

Hi,

Issue was fixed 2 days back after restarting the splunk from /opt/splunk/bin
But we always start, stop the splunk services in /etc/init.d location, after rebooting the server and when we tried to start the service in /etc/init.d it was throwing error like "the command can only be run by bootstart user". Then I started the service in /opt/splunk/bin and it got restarted. Now, I am just curious to know why it was not working under /etc/init.d ???

[nickhills]

is your server using systemd?

[nickhills · Accepted solution]

Assuming linux, and you have sudo access and your server should run as splunk.

sudo su splunk -
/opt/splunk/bin splunk start

[gfreitas]

Check inside splunk-launch.conf for SPLUNK_OS_USER then su to this user and start the Splunk service