{"id":808,"date":"2013-10-15T06:11:08","date_gmt":"2013-10-15T05:11:08","guid":{"rendered":"http:\/\/cdblog.cdstealer.com\/?p=808"},"modified":"2019-04-13T04:03:48","modified_gmt":"2019-04-13T03:03:48","slug":"splunk-systemd","status":"publish","type":"post","link":"https:\/\/cdblog.cdstealer.com\/?p=808","title":{"rendered":"Splunk &#038; Systemd"},"content":{"rendered":"<h2>No longer required from Splunk version 7.2.2 onwards<\/h2>\n<h3>Universal Forwarder<\/h3>\n<p>Copy this text into a file named \"\/usr\/lib\/systemd\/system\/splunkforwarder.service\".<\/p>\n<pre><code>[Unit]\nDescription=Splunk Universal Forwarder\nWants=network.target\nAfter=network.target\n\n[Service]\nType=forking\nRemainAfterExit=yes\nExecStart=\/opt\/splunkforwarder\/bin\/splunk start\nExecStop=\/opt\/splunkforwarder\/bin\/splunk stop\nExecReload=\/opt\/splunkforwarder\/bin\/splunk restart\nStandardOutput=syslog\nRestart=always\n\n[Install]\nWantedBy=multi-user.target\n<\/code><\/pre>\n<p>Next, create a symlink that systemd will use to fetch this control file.<\/p>\n<pre>systemctl enable splunkforwarder<\/pre>\n<p>That's it.&nbsp; You can either reboot or run<\/p>\n<pre>systemctl start splunkforwarder<\/pre>\n\n\n<p class=\"wp-block-paragraph\"><h3>SearchHead, Indexer, Heavy Forwarder<\/h3>\n<p>Copy this text into a file named \"\/usr\/lib\/systemd\/system\/splunkforwarder.service\".<\/p>\n<code><pre>[Unit]\nDescription=Splunk\nWants=network.target\nAfter=network.target\n\n[Service]\nUser=splunk\nGroup=splunk\nType=forking\nRemainAfterExit=yes\nExecStart=\/opt\/splunk\/bin\/splunk start --answer-yes --no-prompt --accept-license\nExecStop=\/opt\/splunk\/bin\/splunk&nbsp;stop\nExecReload=\/opt\/splunk\/bin\/splunk&nbsp;restart\nStandardOutput=syslog\n#ExecStart=\/bin\/sh -c \"echo never &gt;\/sys\/kernel\/mm\/transparent_hugepage\/enabled\"\n#ExecStart=\/bin\/sh -c \"echo never &gt;\/sys\/kernel\/mm\/transparent_hugepage\/defrag\"\n#ulimit&nbsp;-Sn&nbsp;65535\n#ulimit&nbsp;-Hn&nbsp;65535\nLimitNOFILE=65535\n#ulimit&nbsp;-Su&nbsp;20480\n#ulimit&nbsp;-Hu&nbsp;20480\nLimitNPROC=20480\n#ulimit&nbsp;-Hf&nbsp;unlimited\n#ulimit&nbsp;-Sf&nbsp;unlimited\nLimitFSIZE=infinity\nLimitCORE=infinity\n#Restart=always\n\n[Install]\nWantedBy=multi-user.target<\/pre><\/code>\nIf you have THP compiled into your kernel (hint: it's enabled by default), then you'll need to uncomment the two ExecStart lines<\/p>\n","protected":false},"excerpt":{"rendered":"<p>No longer required from Splunk version 7.2.2 onwards Universal Forwarder Copy this text into a file named \"\/usr\/lib\/systemd\/system\/splunkforwarder.service\". [Unit] Description=Splunk Universal Forwarder Wants=network.target After=network.target [Service] Type=forking RemainAfterExit=yes ExecStart=\/opt\/splunkforwarder\/bin\/splunk start ExecStop=\/opt\/splunkforwarder\/bin\/splunk stop ExecReload=\/opt\/splunkforwarder\/bin\/splunk restart StandardOutput=syslog Restart=always [Install] WantedBy=multi-user.target Next, create a symlink that systemd will use to fetch this control file. systemctl enable splunkforwarder That's it.&nbsp; &hellip; <a href=\"https:\/\/cdblog.cdstealer.com\/?p=808\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Splunk &#038; Systemd<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[305],"tags":[172,18,215,173],"class_list":["post-808","post","type-post","status-publish","format-standard","hentry","category-splunk","tag-forwarder","tag-linux","tag-splunk","tag-systemd"],"_links":{"self":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=808"}],"version-history":[{"count":6,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/808\/revisions"}],"predecessor-version":[{"id":1973,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/808\/revisions\/1973"}],"wp:attachment":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}