topic Re: Unable to stop splunk in Deployment Architecture

Unable to stop splunk

rdelhorbe — Mon, 08 Apr 2019 16:00:06 GMT

I run Splunk as a non-root user named splunk

When I try the command /opt/splunk/bin/splunk stop I get :

Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
Failed to stop Splunkd.service: The name org.freedesktop.PolicyKit1 was not provided by any .service files
See system logs and 'systemctl status Splunkd.service' for details.
Systemd manages the Splunk service. Use 'systemctl stop Splunkd' to stop the service. Root permission is required. Login as root user or use sudo.

I tried run the command as root or as splunk non-root user, nothing change.

Re: Unable to stop splunk

muralikoppula — Mon, 08 Apr 2019 18:40:27 GMT

find and kill any lingering processes that contain "splunk" in their name

kill -9 `ps -ef | grep splunk | grep -v grep | awk '{print $2;}'`

and then perform splunk service restart/start as splunk

Hope this helps....

Re: Unable to stop splunk

dm1 — Tue, 09 Nov 2021 22:17:07 GMT

facing the same issue. were you able to fix this ?

Re: Unable to stop splunk

badrinath_itrs — Thu, 18 Nov 2021 02:32:01 GMT

@rdelhorbe @dm1 , If you are running Splunk as systemd service, then it would be better if you use below command to stop SPLUNK.

systemctl stop Splunkd ( # Stop Splunk )
systemctl status Splunkd ( # Status Splunk )
systemctl start Splunkd ( # Start Splunk )

If you have not setup SPLUNK properly to run as systemd service you would need to login with root user to stop it.

Refer this page for more details as how to properly configure Splunk to run as systemd service.

https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/RunSplunkassystemdservice