Boot-start not working on MacOS.

Applicability

Splunk Enterprise MacOS 12.5.1

Description

The installation was made and the boot-start enabled using a custom script. 

/usr/bin/tar xvzf
/tmp/splunkforwarder-9.0.3-dd0128b1f8cd-darwin-universal2.tgz -C
/Applications*and execution was through cli*/Applications/SplunkForwarder/bin/splunk start --accept-license
--answer-yes --auto-ports --no-prompt*Setup to auto start at boot*/Applications/SplunkForwarder/bin/splunk enable boot-start

But Splunk Forwarder will not auto start after reboot.

Investigation

This can happen due to various reasons, it is advised to check the following first: 

• Check the script used.
• Check that the steps here were followed Configure Splunk Enterprise to start at boot time 
• Review permissions on the app. 
• Confirm permissions on the com.splunk.plist file.

However, for this scenario it's not working because the gatekeeper is not going to allow to Splunk to boot-start.

Resolution

To fix the issue when using DMG package, click on allow during installation.
From the CLI/Terminal, there is no popup to prompt to allow.
The macOS is being managed by MDM(mobile device management), the boot start will not work if an exception is not made on the kernel extension.

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release