Trouble with splunkd autostart (boot start) not working on Unix/Linux systems

Applicability

Splunk Enterprise

Description

There are multiple ways to configure Splunk Enterprise and the Splunk Forwarder to boot on startup on *nix machines. Splunk allows the use of init.d or systemd.

Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start
Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start
Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start

Run splunkd as a systemd service

Configure splunkd to start at boot time (init.d)

After following the instructions, there may be issues that prevent auto start from working.

Investigation

init.d:

If splunkd doesn't start, check that the init.d script is present in /etc/init.d/splunk and matches file in the doc link in the Description of this article for configuring splunkd to start at boot time. Pay attention to the su command, if it's not there, you can add it (as mentioned in the documentation) along with adding single quotes around commands. You can try to manually run the script, and if there are errors regarding su permissions, you will have to address those. Make sure the user specified for su exists locally. If they are via managed active directory/LDAP, then specify the init.d script to run after the those users have been loaded (another service script most likely).

systemd:

If splunkd doesn't start, check that the unit file has been created in /etc/systemd/system which should be Splunk.service by default, or the custom name used when configuring systemd. If it is there, review the service file against the doc link in the Description of this article for Running splunkd as a systemd service.

a. There can be an issue where /init.scope/ is added in the path of the cgroups in the ExecStartPost lines for cpu and memory system.slices. Removing that from the path could resolve an issue. See Splunk Answer: Systemd broken on new install in the Related Links section of this article.

b. If having issues, you can check the status of the service with some of the following commands to review the system logs:

systemctl status service-name
journalctl -u service-name.service
journalctl -u service-name.service -b

 

    Check the logs to see why systemd is having issues. One example is if the user assigned to run the splunkd service is not local to the host/OS and is loaded via LDAP or Active Directory. When a systemd service with such a user is trying to be run and the users haven't been populated yet, you'll see something like:

Jan 09 16:09:42 splunkhostname.myorg.com systemd[1]: splunkd.service: main process exited, code=exited, status=217/USER

 

    To resolve something like this, make sure the user exists (create a local user) or if this user is being populated via LDAP or Active Directory, then set this systemd Unit to start after the service that does the user population with the key: After=yourldaploader.service .

For any cases, web search is your friend, you can run a search on Google/Bing/Duckduckgo or your preferred search engine and should be able to find leads that help you resolve your issue. If you're not familiar with the issues, then seek the assistance of a Unix/Linux system administrator who should be able to help.

Resolution

Follow the steps in the investigation to make sure that the desired method of boot start is configured, review the scripts (comparing against Splunk docs), try to run them to see if there are any issues, review logs for any issues and search against them to find a solutions. Links are provided in the Related Links section to aid in review.

Related Links

Splunk Doc:- Configuring Splunk to start at boottime

Splunk Doc: Run Splunk as a systemd service

Checking logs of systemd

Start a systemd service after specific service

Splunk Answer: Systemd broken on new install

Lots of good things to check within the threads of this answer, including /init.scope/ in path of ExexStartPost lines of service script

Debugging systemctl code exited 217/USER

Adding debug to init.d scripts

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release