topic Re: Splunkd is running after ./splunk stop command in Installation

Splunkd is running after ./splunk stop command

marisstella — Sat, 06 Jun 2020 16:44:17 GMT

Hii all,
I have created a copy of splunk instance, in the same server for testing purpose.. in this new splunk we will upgrade the version n check if the apps are working fine or not...
I copied some of the apps from old one to new splunk.. but here the issue is when i run ./splunk stop.. it only stopping SPLUNKWEB and SPLUNKD is running... But when i check it splunkweb is also running...
I don't whats happening...

Can as anybody tell me how to stop splunkd n splunkweb at a time??
Can you guys Guess my situation??

Re: Splunkd is running after ./splunk stop command

nareshinsvu — Wed, 07 Aug 2019 06:41:17 GMT

Did you try stopping splunk using absolute path ? like

/opt/blah/blah/Splunk/bin/splunk stop

Check out this blog if it helps

https://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

Re: Splunkd is running after ./splunk stop command

marisstella — Wed, 07 Aug 2019 08:35:13 GMT

Yes, I tried that.... splunk is still running only splunkweb stopped..

Re: Splunkd is running after ./splunk stop command

sloshburch — Wed, 07 Aug 2019 14:19:34 GMT

What is showing you Splunk is still running?

Re: Splunkd is running after ./splunk stop command

sloshburch — Wed, 07 Aug 2019 14:21:48 GMT

If you copied Splunk while it was running then it probably copied the splunk.pid files. Therefore, when you try to stop splunk from the new copied version, it will think the old version's processes are it's own and try to stop them. Furthermore, you should be experiencing port conflicts.

I highly recommend you do not do such testing on the same machine. It will require a lot of extra work to ensure no port collisions and avoid these quirks. Copy Splunk to a new VM. This can be done with Docker, VirtualBox, cloud providers, etc...