upstart config for splunkforwarder

splunkforwarder.conf

# vi:ft=upstart:
# this is really the only logical way to start the thing
# upstart doesn't take kindly to process startup that forks more than twice
# and custom stops in pre-stop don't really work quite right. If you want this tracking sorta
# the right pid in 'service splunkforwarder status' then you have to --nodaemon (imo)
# -jettero@gmail.com

description "Splunk Forwarder"

start on (net-device-up
          and local-filesystems
          and runlevel [2345])

stop on runlevel [016]

respawn limit 10 5
console output

setgid splunk
setuid splunk

# Forks | no expect         | expect fork       | expect daemon
# ------+-------------------+-------------------+---------------
# 0     | Correct           | start hangs       | start hangs
# 1     | Wrong pid tracked | Correct           | start hangs
# 2     | Wrong pid tracked | Wrong pid tracked | Correct
#
# expect something

script
    /opt/splunkforwarder/bin/splunk --accept-license --answer-yes --no-prompt start splunkd --nodaemon
end script