1. useradd splunk
2. tar zxf splunk-6.4.0-f2c836328108-Linux-x86_64.tgz -C /opt
3. chown -R splunk:splunk /opt/splunk
4. su - splunk
/opt/splunk/bin/splunk start --accept-license
/opt/splunk/bin/splunk enable boot-start -user splunk (this will create init script for CentOS 6, for CentOS 7 systemd script, check below)
5. reboot and make sure splunk starts up as expected
ss -lnt
ps -ef | grep splunk
Notes: above step is same as Ubuntu 14.04 (useradd -m splunk)
for CentOS 7 systemd script:
vi /usr/lib/systemd/system/splunk.service
[Unit]
Description=Splunk
After=network.target
[Service]
RemainAfterExit=yes
ExecStart=/opt/splunk/bin/splunk start
ExecStop=/opt/splunk/bin/splunk stop
ExecReload=/opt/splunk/bin/splunk restart
User=splunk
Group=splunk
[Install]
WantedBy=multi-user.target
systemctl enable splunk
for universal forwarder installation on CentOS 6:
useradd splunk
tar zxf splunkforwarder-6.4.0-f2c836328108-Linux-x86_64.gz -C /opt
chown -R splunk:splunk /opt/splunkforwarder/
su - splunk
/opt/splunkforwarder/bin/splunk start --accept-license
/opt/splunkforwarder/bin/splunk enable boot-start -user splunk |