Set up SysV init script for Splunk

Posted October 3rd, 2011 in Applications

Splunk is a useful tool for collating and reporting on data in real-time. I've been recently setting it up for a customer and this little post is for self-reference so I don't get stuck next time trying to work out how to have Splunk start and stop automatically when the system starts and stops, using SysV init scripts. I couldn't see in the documentation where it was but worked it out in the end.

Enabling Splunk on system startup

I have Splunk installed on 2 Linux servers at /opt/splunk and /opt/splunkforwarder (the second one forwards data to the main Splunk instance). I think this is where Splunk installs everything by default so you can probably simply copy and paste the commands below. If your install is somewhere else, then adjust the paths.

Splunk

sudo /opt/splunk/bin/splunk enable boot-start

Splunk Forwarder

sudo /opt/splunkforwarder/bin/splunk enable boot-start

That's all there is to it. The necessary shell script and init symlinks will now have been created at /etc/init.d etc and Splunk will now start when the system starts, and be stopped before the system halts.