I am running Splunk 7.0.2 on RHEL 7.4 and use the following splunk.service for systemd.
[Unit]
Description=Splunk Enterprise 7.0.2
After=network.target
Wants=network.target
[Service]
Type=forking
User=splunk
Group=splunk
LimitNOFILE=65536
ExecStart=/opt/splunk/bin/splunk start
ExecStop=/opt/splunk/bin/splunk stop
ExecReload=/opt/splunk/bin/splunk restart
PIDFile=/opt/splunk/var/run/splunk/splunkd.pid
[Install]
WantedBy=multi-user.target
# If you want to use $(systemctl [start|stop|restart] splunk) instead of splunkd ...
Alias=splunk.service
This runs splunk as the splunk user so you need to ensure that splunk owns all the files in your $SPLUNK_HOME dir.
This works fine when all the splunk ports are above 1024.
... View more