- Splunk Answers
- :
- Splunk Administration
- :
- Security
- :
- Re: bootstart user
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
After rebooting the server when I checked splunk services were not running. So I tried to start the splunk services, but getting the below error
this command can only be run by bootstart user
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming linux, and you have sudo access and your server should run as splunk.
sudo su splunk -
/opt/splunk/bin splunk start
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
/etc/init.d/splunk start used to work running as the root user and we're trying to troubleshoot why it suddenly stopped working?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd recommend you check splunk-launch.conf for the user, su to the user: su <user> and then run /opt/splunk/bin/splunk start and see what error messages it shows (if any) and please note I assumed Splunk is installed under /opt/splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Issue was fixed 2 days back after restarting the splunk from /opt/splunk/bin
But we always start, stop the splunk services in /etc/init.d location, after rebooting the server and when we tried to start the service in /etc/init.d it was throwing error like "the command can only be run by bootstart user". Then I started the service in /opt/splunk/bin and it got restarted. Now, I am just curious to know why it was not working under /etc/init.d ???
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is your server using systemd?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming linux, and you have sudo access and your server should run as splunk.
sudo su splunk -
/opt/splunk/bin splunk start
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check inside splunk-launch.conf for SPLUNK_OS_USER then su to this user and start the Splunk service
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
