topic Re: restarting splunk from script input in Getting Data In

restarting splunk from script input

Cstone1 — Wed, 28 Oct 2020 19:31:38 GMT

trying to restart splunk via a script... everything in the script works fine but when the restart happens the script dies at that point too. how to have splunk start the script on startup and when it does the restart, keep the script running and let it complete on its own (windows and linux)?

Re: restarting splunk from script input

nwuest — Mon, 02 Nov 2020 07:08:24 GMT

Hi @Cstone1,

Are you wanting to have a splunk "instance", kick-off a script (via an app) that does a restart (of the splunk service I'm guessing) that of which keeps the script running after the restart portion?

Might I ask as to what you are trying to accomplish before and after you are wanting the splunk service to restart?

I look forward to hearing from you

V/R,
nwuest

Re: restarting splunk from script input

Cstone1 — Fri, 06 Nov 2020 00:49:13 GMT

cuz I'd like to shut it down, back it up, upgrade it and restart it.

Re: restarting splunk from script input

nwuest — Sat, 07 Nov 2020 04:29:51 GMT

Hi @Cstone1,

So if I'm reading this right, you are "restarting" splunk after you upgrade it?

If so, that is where the script is breaking. After you upgrade a Splunk Instance, you need to accept the End User License Agreement again before it will even start.
Splunk cannot "restart" an instance that hasn't made it past the End User License Agreement step.

You can accept the license but instead of "splunk restart" you should use the following command depending on your splunk instance:

Splunk Enterprise:
"/opt/splunk/bin/splunk start --accept-license"
- OR-
Splunk Universal Forwarder:
"/opt/splunkforwarder/bin/splunk start --accept-license"

Let us know if this fixes your script!

V/R,
nwuest

Re: restarting splunk from script input

Cstone1 — Sun, 08 Nov 2020 06:50:14 GMT

hi thx for the reply but, no not quite.

In windows the MSI will install while splunk is running and restart it after its done. But in linux its a TGZ extract (not locking it to a specific distro using rpms or debs etc).

Extracting it while running causes a lot of errors and sometimes succeeds but not reliable.

So a very highlevel sequence is this

1. do all checks

2. stop splunk

3. create backup

script dies when splunk stops so a partial backup is made.

4. untar new

5. restart with accept lic and answer yes

ill add, that when i run it manually it works fine.