Hi,
did have same problem.
My problem was i did install first time the splunkforwarder with"splunk enable boot-start".
This makes entries in SRCsubsys of aix:
Check if entry exists:
odmget SRCsubsys | grep splunk
Get rid of entries with
sudo .../.splunk disable boot-start
Check if entry exists, and start splunk with wrapper script as user splunk, and never as user root like:
$ cat rc.splunk
#!/bin/ksh
### Script Variables
APPDIR=/usr/local/splunk/splunkforwarder/bin
APPNAME=splunk
RUN_USER=splunk
#export JAVA_HOME=/usr/java7_64
case "$1" in
start )
echo "Starting the ${APPNAME} Application"
su $RUN_USER -c ${APPDIR}/${APPNAME} start
;;
stop )
echo "stopping the Application"
su $RUN_USER -c ${APPDIR}/${APPNAME} stop
;;
restart )
echo "restarting the ${APPNAME} Application"
su $RUN_USER -c ${APPDIR}/${APPNAME} stop
su $RUN_USER -c ${APPDIR}/${APPNAME} start
;;
* )
echo "Usage: $0 COMMAND"
echo "---------------------------"
echo "start - Start ${APPNAME} instance in ${APPDIR}"
echo "stop - Stop ${APPNAME} instance in ${APPDIR}"
echo "restart - Stop ${APPNAME} instance in ${APPDIR}"
echo
exit 1
esac
Hope thie helps
cheers, pit
... View more